Implemented IPsec policies restricted to given network interface

diff --git a/src/libcharon/config/child_cfg.c b/src/libcharon/config/child_cfg.c
index a7ec167a4fe151c1a86c1ef416f5b37c32220a73..be84621d4de29abd07db1ab11cbaeaf5aaab675b 100644 (file)
--- a/src/libcharon/config/child_cfg.c
+++ b/src/libcharon/config/child_cfg.c
@@ -138,6 +138,11 @@ struct private_child_cfg_t {
         */
        uint32_t manual_prio;
 
+       /**
+        * Optional restriction of IPsec policy to a given network interface
+        */
+       char *interface;
+
        /**
         * set up IPsec transport SA in MIPv6 proxy mode
         */
@@ -512,6 +517,12 @@ METHOD(child_cfg_t, get_manual_prio, uint32_t,
        return this->manual_prio;
 }
 
+METHOD(child_cfg_t, get_interface, char*,
+       private_child_cfg_t *this)
+{
+       return this->interface;
+}
+
 METHOD(child_cfg_t, get_replay_window, uint32_t,
        private_child_cfg_t *this)
 {
@@ -537,7 +548,7 @@ METHOD(child_cfg_t, install_policy, bool,
 }
 
 #define LT_PART_EQUALS(a, b) ({ a.life == b.life && a.rekey == b.rekey && a.jitter == b.jitter; })
-#define LIFETIME_EQUALS(a, b) ({  LT_PART_EQUALS(a.time, b.time) && LT_PART_EQUALS(a.bytes, b.bytes) && LT_PART_EQUALS(a.packets, b.packets); })
+#define LIFETIME_EQUALS(a, b) ({ LT_PART_EQUALS(a.time, b.time) && LT_PART_EQUALS(a.bytes, b.bytes) && LT_PART_EQUALS(a.packets, b.packets); })
 
 METHOD(child_cfg_t, equals, bool,
        private_child_cfg_t *this, child_cfg_t *other_pub)
@@ -585,7 +596,8 @@ METHOD(child_cfg_t, equals, bool,
                this->replay_window == other->replay_window &&
                this->proxy_mode == other->proxy_mode &&
                this->install_policy == other->install_policy &&
-               streq(this->updown, other->updown);
+               streq(this->updown, other->updown) &&
+               streq(this->interface, other->interface);
 }
 
 METHOD(child_cfg_t, get_ref, child_cfg_t*,
@@ -603,10 +615,8 @@ METHOD(child_cfg_t, destroy, void,
                this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
                this->my_ts->destroy_offset(this->my_ts, offsetof(traffic_selector_t, destroy));
                this->other_ts->destroy_offset(this->other_ts, offsetof(traffic_selector_t, destroy));
-               if (this->updown)
-               {
-                       free(this->updown);
-               }
+               free(this->updown);
+               free(this->interface);
                free(this->name);
                free(this);
        }
@@ -641,6 +651,7 @@ child_cfg_t *child_cfg_create(char *name, child_cfg_create_t *data)
                        .get_mark = _get_mark,
                        .get_tfc = _get_tfc,
                        .get_manual_prio = _get_manual_prio,
+                       .get_interface = _get_interface,
                        .get_replay_window = _get_replay_window,
                        .set_replay_window = _set_replay_window,
                        .use_proxy_mode = _use_proxy_mode,
@@ -665,6 +676,7 @@ child_cfg_t *child_cfg_create(char *name, child_cfg_create_t *data)
                .use_ipcomp = data->ipcomp,
                .tfc = data->tfc,
                .manual_prio = data->priority,
+               .interface = strdupnull(data->interface),
                .install_policy = !data->suppress_policies,
                .refcount = 1,
                .proposals = linked_list_create(),

diff --git a/src/libcharon/config/child_cfg.h b/src/libcharon/config/child_cfg.h
index 8ac9c30ca046aa4130c4ef9f160c74859f4d4a5e..7d348fd6ca9bc8c8a2867f659fee570f8b43b047 100644 (file)
--- a/src/libcharon/config/child_cfg.h
+++ b/src/libcharon/config/child_cfg.h
@@ -243,6 +243,13 @@ struct child_cfg_t {
         */
        uint32_t (*get_manual_prio)(child_cfg_t *this);
 
+       /**
+        * Get optional network interface restricting IPsec policy
+        *
+        * @return                              network interface)
+        */
+       char* (*get_interface)(child_cfg_t *this);
+
        /**
         * Get anti-replay window size
         *
@@ -318,6 +325,8 @@ struct child_cfg_create_t {
        uint32_t tfc;
        /** Optional manually-set IPsec policy priority */
        uint32_t priority;
+       /** Optional network interface restricting IPsec policy (cloned) */
+       char *interface;
        /** lifetime_cfg_t for this child_cfg */
        lifetime_cfg_t lifetime;
        /** Inactivity timeout in s before closing a CHILD_SA */

diff --git a/src/libcharon/kernel/kernel_ipsec.h b/src/libcharon/kernel/kernel_ipsec.h
index 3a06ce66b23477e67e2433d3f57a3662707c9813..0ad566068bf2c7da1ee6615db38be765c3ccd376 100644 (file)
--- a/src/libcharon/kernel/kernel_ipsec.h
+++ b/src/libcharon/kernel/kernel_ipsec.h
@@ -69,6 +69,8 @@ struct kernel_ipsec_add_sa_t {
        linked_list_t *src_ts;
        /** List of destination traffic selectors */
        linked_list_t *dst_ts;
+       /** Network interface restricting policy */
+       char *interface;
        /** Lifetime configuration */
        lifetime_cfg_t *lifetime;
        /** Encryption algorithm */
@@ -142,6 +144,8 @@ struct kernel_ipsec_policy_id_t {
        traffic_selector_t *dst_ts;
        /** Optional mark */
        mark_t mark;
+       /** Network interface restricting policy */
+       char *interface;
 };
 
 /**

diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index bad343ebaa3df5efdf658f882d3fd336dd97addc..95c0e3ce0deffeb08e0104f3d315513b52864974 100644 (file)
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -26,6 +26,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/xfrm.h>
 #include <linux/udp.h>
+#include <net/if.h>
 #include <unistd.h>
 #include <time.h>
 #include <errno.h>
@@ -739,7 +740,8 @@ static void ts2ports(traffic_selector_t* ts,
  * Convert a pair of traffic_selectors to an xfrm_selector
  */
 static struct xfrm_selector ts2selector(traffic_selector_t *src,
-                                                                               traffic_selector_t *dst)
+                                                                               traffic_selector_t *dst,
+                                                                               char *interface)
 {
        struct xfrm_selector sel;
        uint16_t port;
@@ -763,7 +765,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
                sel.dport = htons(traffic_selector_icmp_code(port));
                sel.dport_mask = sel.dport ? ~0 : 0;
        }
-       sel.ifindex = 0;
+       sel.ifindex = interface ? if_nametoindex(interface) : 0;
        sel.user = 0;
 
        return sel;
@@ -1279,7 +1281,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
                                data->dst_ts->get_first(data->dst_ts,
                                                                                (void**)&first_dst_ts) == SUCCESS)
                        {
-                               sa->sel = ts2selector(first_src_ts, first_dst_ts);
+                               sa->sel = ts2selector(first_src_ts, first_dst_ts,
+                                                                         data->interface);
                                if (!this->proto_port_transport)
                                {
                                        /* don't install proto/port on SA. This would break
@@ -2358,7 +2361,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
 
        /* create a policy */
        INIT(policy,
-               .sel = ts2selector(id->src_ts, id->dst_ts),
+               .sel = ts2selector(id->src_ts, id->dst_ts, id->interface),
                .mark = id->mark.value & id->mark.mask,
                .direction = id->dir,
                .reqid = data->sa->reqid,
@@ -2468,7 +2471,7 @@ METHOD(kernel_ipsec_t, query_policy, status_t,
        hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id));
 
        policy_id = NLMSG_DATA(hdr);
-       policy_id->sel = ts2selector(id->src_ts, id->dst_ts);
+       policy_id->sel = ts2selector(id->src_ts, id->dst_ts, id->interface);
        policy_id->dir = id->dir;
 
        if (!add_mark(hdr, sizeof(request), id->mark))
@@ -2552,7 +2555,7 @@ METHOD(kernel_ipsec_t, del_policy, status_t,
 
        /* create a policy */
        memset(&policy, 0, sizeof(policy_entry_t));
-       policy.sel = ts2selector(id->src_ts, id->dst_ts);
+       policy.sel = ts2selector(id->src_ts, id->dst_ts, id->interface);
        policy.mark = id->mark.value & id->mark.mask;
        policy.direction = id->dir;
 

diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 8358336af7eafedfbd425b43e2f70aba9d7188d7..a1ab56df9c273c8edba2b808ebbac4c89f19eef4 100644 (file)
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -462,6 +462,7 @@ static void log_child_data(child_data_t *data, char *name)
        DBG2(DBG_CFG, "   reqid = %u", cfg->reqid);
        DBG2(DBG_CFG, "   tfc = %d", cfg->tfc);
        DBG2(DBG_CFG, "   priority = %d", cfg->priority);
+       DBG2(DBG_CFG, "   interface = %s", cfg->interface);
        DBG2(DBG_CFG, "   mark_in = %u/%u",
                 cfg->mark_in.value, cfg->mark_in.mask);
        DBG2(DBG_CFG, "   mark_out = %u/%u",
@@ -484,6 +485,7 @@ static void free_child_data(child_data_t *data)
        data->remote_ts->destroy_offset(data->remote_ts,
                                                                        offsetof(traffic_selector_t, destroy));
        free(data->cfg.updown);
+       free(data->cfg.interface);
 }
 
 /**
@@ -1342,6 +1344,7 @@ CALLBACK(child_kv, bool,
                { "mark_out",           parse_mark,                     &child->cfg.mark_out                            },
                { "tfc_padding",        parse_tfc,                      &child->cfg.tfc                                         },
                { "priority",           parse_uint32,           &child->cfg.priority                            },
+               { "interface",          parse_string,           &child->cfg.interface                           },
        };
 
        return parse_rules(rules, countof(rules), name, value,

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index a1e47a2a4a1c82f4de2788beff49fae07bb1f9df..6e0113ee729ca950e8bdd21452fce6fc4af4bda9 100644 (file)
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -576,6 +576,7 @@ static bool update_usetime(private_child_sa_t *this, bool inbound)
                                .src_ts = my_ts,
                                .dst_ts = other_ts,
                                .mark = this->mark_out,
+                               .interface = this->config->get_interface(this->config),
                        };
                        kernel_ipsec_query_policy_t query = {};
 
@@ -798,6 +799,7 @@ METHOD(child_sa_t, install, status_t,
                .mode = this->mode,
                .src_ts = src_ts,
                .dst_ts = dst_ts,
+               .interface = inbound ? NULL : this->config->get_interface(this->config),
                .lifetime = lifetime,
                .enc_alg = enc_alg,
                .enc_key = encr,
@@ -890,6 +892,7 @@ static status_t install_policies_internal(private_child_sa_t *this,
                .src_ts = my_ts,
                .dst_ts = other_ts,
                .mark = this->mark_out,
+               .interface = this->config->get_interface(this->config),
        }, in_id = {
                .dir = POLICY_IN,
                .src_ts = other_ts,
@@ -948,6 +951,7 @@ static void del_policies_internal(private_child_sa_t *this,
                .src_ts = my_ts,
                .dst_ts = other_ts,
                .mark = this->mark_out,
+               .interface = this->config->get_interface(this->config),
        }, in_id = {
                .dir = POLICY_IN,
                .src_ts = other_ts,

diff --git a/src/libcharon/sa/shunt_manager.c b/src/libcharon/sa/shunt_manager.c
index b74b454ea9eb6f30b1a27e6c2b39de4d3ccdc870..40e291be57d87e7c445ac2907ad673c10c94c00b 100644 (file)
--- a/src/libcharon/sa/shunt_manager.c
+++ b/src/libcharon/sa/shunt_manager.c
@@ -68,6 +68,8 @@ static bool install_shunt_policy(child_cfg_t *child)
        policy_type_t policy_type;
        policy_priority_t policy_prio;
        status_t status = SUCCESS;
+       uint32_t manual_prio;
+       char *interface;
        ipsec_sa_cfg_t sa = { .mode = MODE_TRANSPORT };
 
        switch (child->get_mode(child))
@@ -92,6 +94,9 @@ static bool install_shunt_policy(child_cfg_t *child)
        other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, hosts);
        hosts->destroy(hosts);
 
+       manual_prio = child->get_manual_prio(child);
+       interface = child->get_interface(child);
+
        /* enumerate pairs of traffic selectors */
        e_my_ts = my_ts_list->create_enumerator(my_ts_list);
        while (e_my_ts->enumerate(e_my_ts, &my_ts))
@@ -115,11 +120,12 @@ static bool install_shunt_policy(child_cfg_t *child)
                                .src_ts = my_ts,
                                .dst_ts = other_ts,
                                .mark = child->get_mark(child, FALSE),
+                               .interface = interface,
                        };
                        kernel_ipsec_manage_policy_t policy = {
                                .type = policy_type,
                                .prio = policy_prio,
-                               .manual_prio = child->get_manual_prio(child),
+                               .manual_prio = manual_prio,
                                .src = host_any,
                                .dst = host_any,
                                .sa = &sa,
@@ -134,6 +140,7 @@ static bool install_shunt_policy(child_cfg_t *child)
                                .src_ts = other_ts,
                                .dst_ts = my_ts,
                                .mark = child->get_mark(child, TRUE),
+                               .interface = interface,
                        };
                        status |= charon->kernel->add_policy(charon->kernel, &id, &policy);
                        /* install "inbound" forward policy */
@@ -215,6 +222,8 @@ static void uninstall_shunt_policy(child_cfg_t *child)
        policy_type_t policy_type;
        policy_priority_t policy_prio;
        status_t status = SUCCESS;
+       uint32_t manual_prio;
+       char *interface;
        ipsec_sa_cfg_t sa = { .mode = MODE_TRANSPORT };
 
        switch (child->get_mode(child))
@@ -239,6 +248,9 @@ static void uninstall_shunt_policy(child_cfg_t *child)
        other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, hosts);
        hosts->destroy(hosts);
 
+       manual_prio = child->get_manual_prio(child);
+       interface = child->get_interface(child);
+
        /* enumerate pairs of traffic selectors */
        e_my_ts = my_ts_list->create_enumerator(my_ts_list);
        while (e_my_ts->enumerate(e_my_ts, &my_ts))
@@ -262,11 +274,12 @@ static void uninstall_shunt_policy(child_cfg_t *child)
                                .src_ts = my_ts,
                                .dst_ts = other_ts,
                                .mark = child->get_mark(child, FALSE),
+                               .interface = interface,
                        };
                        kernel_ipsec_manage_policy_t policy = {
                                .type = policy_type,
                                .prio = policy_prio,
-                               .manual_prio = child->get_manual_prio(child),
+                               .manual_prio = manual_prio,
                                .src = host_any,
                                .dst = host_any,
                                .sa = &sa,
@@ -281,6 +294,7 @@ static void uninstall_shunt_policy(child_cfg_t *child)
                                .src_ts = other_ts,
                                .dst_ts = my_ts,
                                .mark = child->get_mark(child, TRUE),
+                               .interface = interface,
                        };
                        status |= charon->kernel->del_policy(charon->kernel, &id, &policy);
                        /* uninstall "inbound" forward policy */

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 08d3cf1c98cac009b00c7e634bec3e7eca5d6a05..fe5b293fb2b26768b82cc4f7a36bbb5a37589772 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -691,6 +691,9 @@ connections.<conn>.children.<child>.priority = 0
        high-priority drop policies.  The default of _0_ uses dynamically calculated
        priorities based on the size of the traffic selectors.
 
+connections.<conn>.children.<child>.interface =
+       Optional interface name to restrict IPsec policies.
+
 connections.<conn>.children.<child>.mark_in = 0/0x00000000
        Netfilter mark and mask for input traffic.