added firewalling support when using virtual IPs

diff --git a/src/charon/sa/child_sa.c b/src/charon/sa/child_sa.c
index e9ecde112c663f0fd145f299e98420b67efbfb10..76e0dc0e1243b7d03016638a838af600e75bd593 100644 (file)
--- a/src/charon/sa/child_sa.c
+++ b/src/charon/sa/child_sa.c
@@ -143,6 +143,11 @@ struct private_child_sa_t {
         */
        mode_t mode;
        
+       /**
+        * virtual IP assinged to local host
+        */
+       host_t *virtual_ip;
+       
        /**
         * policy used to create this child
         */
@@ -223,8 +228,7 @@ static void updown(private_child_sa_t *this, bool up)
                char command[1024];
                char *ifname = NULL;
                char *my_client, *other_client, *my_client_mask, *other_client_mask;
-               char *virtual_ip;
-               char *pos;
+               char *pos, *virtual_ip;
                FILE *shell;
                
                /* get subnet/bits from string */
@@ -246,20 +250,16 @@ static void updown(private_child_sa_t *this, bool up)
                {
                        *pos = '\0';
                }
-               
-               /* do we have a local virtual IP? */
-               {
-                       host_t *vip = NULL;
 
-                       if (vip)
-                       {
-                               asprintf(&virtual_ip, "MY_SOURCEIP='%H' ", vip);
-                       }
-                       else
-                       {
-                               asprintf(&virtual_ip, "");
-                       }
-               }
+        if (this->virtual_ip)
+        {
+                asprintf(&virtual_ip, "PLUTO_MY_SOURCEIP='%H' ",
+                                this->virtual_ip);
+        }
+        else
+        {
+                asprintf(&virtual_ip, "");
+        }
 
                charon->socket->is_local_address(charon->socket, this->me.addr, &ifname);
                
@@ -991,6 +991,14 @@ static status_t update_hosts(private_child_sa_t *this, host_t *new_me, host_t *n
        return SUCCESS;
 }
 
+/**
+ * Implementation of child_sa_t.set_virtual_ip.
+ */
+static void set_virtual_ip(private_child_sa_t *this, host_t *ip)
+{
+       this->virtual_ip = ip->clone(ip);
+}
+
 /**
  * Implementation of child_sa_t.destroy.
  */
@@ -1053,6 +1061,7 @@ static void destroy(private_child_sa_t *this)
        this->me.id->destroy(this->me.id);
        this->other.id->destroy(this->other.id);
        this->policy->destroy(this->policy);
+       DESTROY_IF(this->virtual_ip);
        free(this);
 }
 
@@ -1082,6 +1091,7 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
        this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
        this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
        this->public.get_policy = (policy_t*(*)(child_sa_t*))get_policy;
+       this->public.set_virtual_ip = (void(*)(child_sa_t*,host_t*))set_virtual_ip;
        this->public.destroy = (void(*)(child_sa_t*))destroy;
 
        /* private data */
@@ -1106,6 +1116,7 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
        this->other_ts = linked_list_create();
        this->protocol = PROTO_NONE;
        this->mode = MODE_TUNNEL;
+       this->virtual_ip = NULL;
        this->policy = policy;
        policy->get_ref(policy);
        

diff --git a/src/charon/sa/child_sa.h b/src/charon/sa/child_sa.h
index bd0e032da70c80d89fad2466a91f823336c82d54..216e56659e2bd89c2c6c4fabd37c44ff522714a0 100644 (file)
--- a/src/charon/sa/child_sa.h
+++ b/src/charon/sa/child_sa.h
@@ -258,6 +258,17 @@ struct child_sa_t {
         */
        policy_t* (*get_policy) (child_sa_t *this);
        
+       /**
+        * @brief Set the virtual IP used received from IRAS.
+        *
+        * To allow proper setup of firewall rules, the virtual IP is required
+        * for filtering.
+        *
+        * @param this          calling object
+        * @param ip            own virtual IP
+        */
+       void (*set_virtual_ip) (child_sa_t *this, host_t *ip);
+       
        /**
         * @brief Destroys a child_sa.
         *

diff --git a/src/charon/sa/tasks/child_create.c b/src/charon/sa/tasks/child_create.c
index 165baa4beed891af063fdf53f9e10b4531ee8f79..16b21eb4a2bcf15ac7a0e0c73b3ece403532cf15 100644 (file)
--- a/src/charon/sa/tasks/child_create.c
+++ b/src/charon/sa/tasks/child_create.c
@@ -198,7 +198,9 @@ static status_t select_and_install(private_child_create_t *this)
        if (this->initiator && my_vip)
        {       /* if we have a virtual IP, shorten our TS to the minimum */
                my_ts = this->policy->select_my_traffic_selectors(this->policy, my_ts,
-                                                                                                                       my_vip);
+                                                                                                                 my_vip);
+               /* to setup firewall rules correctly, CHILD_SA needs the virtual IP */
+               this->child_sa->set_virtual_ip(this->child_sa, my_vip);
        }
        else
        {       /* shorten in the host2host case only */