kernel-interface: Add a separate "update" flag to add_sa()

The current "inbound" flag is used for two purposes: To define the actual
direction of the SA, but also to determine the operation used for SA
installation. If an SPI has been allocated, an update operation is required
instead of an add.

While the inbound flag normally defines the kind of operation required, this
is not necessarily true in all cases. On the HA passive node, we install inbound
SAs without prior SPI allocation.

diff --git a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
index 69341a4f5a55ed841f6548beefbe7886ebb33e1f..734b1ec556d4a2a12b6c513eafb22f8553da2acd 100644 (file)
--- a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
+++ b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
@@ -86,7 +86,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t* src_ts, linked_list_t* dst_ts)
 {
        esa_info_t esa;

diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
index e6c5d6a1df940b1a0ea9518328bbd34734563b48..eabcb931115929543cfae571a92586c95c3b287b 100644 (file)
--- a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
+++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
@@ -254,7 +254,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        return ipsec->sas->add_sa(ipsec->sas, src, dst, spi, protocol, reqid, mark,

diff --git a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
index 86db9e64382a9151e635eabe85064f4e1465d2eb..b38ded846379a8ef6bdc4ccbe9cacf4a09a637b3 100644 (file)
--- a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
+++ b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
@@ -2103,7 +2103,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        host_t *local, *remote;

diff --git a/src/libcharon/plugins/load_tester/load_tester_ipsec.c b/src/libcharon/plugins/load_tester/load_tester_ipsec.c
index 68af4794d0802ca5c3f6959ab8b79f726929e878..62d43e302b2a9e4e537e220f49f6fa221f8e1dee 100644 (file)
--- a/src/libcharon/plugins/load_tester/load_tester_ipsec.c
+++ b/src/libcharon/plugins/load_tester/load_tester_ipsec.c
@@ -55,7 +55,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        return SUCCESS;

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index 1f37fac657d5b6a4c5750240a560d1893c1a9331..9c74b95170a0eba48e21200d3ce4dc0ef7a9bc52 100644 (file)
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -750,7 +750,7 @@ METHOD(child_sa_t, install, status_t,
                                inbound ? this->mark_in : this->mark_out, tfc,
                                lifetime, enc_alg, encr, int_alg, integ, this->mode,
                                this->ipcomp, cpi, this->config->get_replay_window(this->config),
-                               initiator, this->encap, esn, update, src_ts, dst_ts);
+                               initiator, this->encap, esn, inbound, update, src_ts, dst_ts);
 
        free(lifetime);
 

diff --git a/src/libhydra/kernel/kernel_interface.c b/src/libhydra/kernel/kernel_interface.c
index 943b513b20f5240797de26870f4fdb29c8b57e9f..ce31bd41073e4b13a782f644512e8ebad6da7b9a 100644 (file)
--- a/src/libhydra/kernel/kernel_interface.c
+++ b/src/libhydra/kernel/kernel_interface.c
@@ -421,7 +421,7 @@ METHOD(kernel_interface_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        if (!this->ipsec)
@@ -431,7 +431,7 @@ METHOD(kernel_interface_t, add_sa, status_t,
        return this->ipsec->add_sa(this->ipsec, src, dst, spi, protocol, reqid,
                                mark, tfc, lifetime, enc_alg, enc_key, int_alg, int_key, mode,
                                ipcomp, cpi, replay_window, initiator, encap, esn, inbound,
-                               src_ts, dst_ts);
+                               update, src_ts, dst_ts);
 }
 
 METHOD(kernel_interface_t, update_sa, status_t,

diff --git a/src/libhydra/kernel/kernel_interface.h b/src/libhydra/kernel/kernel_interface.h
index 2d484251fa78bcea0a1983c915d4e3025d739d32..96ce9e26d459affce1c48ae9490541f595010e5d 100644 (file)
--- a/src/libhydra/kernel/kernel_interface.h
+++ b/src/libhydra/kernel/kernel_interface.h
@@ -180,6 +180,7 @@ struct kernel_interface_t {
         * @param encap                 enable UDP encapsulation for NAT traversal
         * @param esn                   TRUE to use Extended Sequence Numbers
         * @param inbound               TRUE if this is an inbound SA
+        * @param update                TRUE if an SPI has already been allocated for SA
         * @param src_ts                list of source traffic selectors
         * @param dst_ts                list of destination traffic selectors
         * @return                              SUCCESS if operation completed
@@ -191,8 +192,8 @@ struct kernel_interface_t {
                                                u_int16_t enc_alg, chunk_t enc_key,
                                                u_int16_t int_alg, chunk_t int_key,
                                                ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
-                                               u_int32_t replay_window,
-                                               bool initiator, bool encap, bool esn, bool inbound,
+                                               u_int32_t replay_window, bool initiator, bool encap,
+                                               bool esn, bool inbound, bool update,
                                                linked_list_t *src_ts, linked_list_t *dst_ts);
 
        /**

diff --git a/src/libhydra/kernel/kernel_ipsec.h b/src/libhydra/kernel/kernel_ipsec.h
index f6705ff88ff46549d3ce304a48e7a64848ad884e..19caaa400be953511cf92194a4e7acbff2a79730 100644 (file)
--- a/src/libhydra/kernel/kernel_ipsec.h
+++ b/src/libhydra/kernel/kernel_ipsec.h
@@ -101,6 +101,7 @@ struct kernel_ipsec_t {
         * @param encap                 enable UDP encapsulation for NAT traversal
         * @param esn                   TRUE to use Extended Sequence Numbers
         * @param inbound               TRUE if this is an inbound SA
+        * @param update                TRUE if an SPI has already been allocated for SA
         * @param src_ts                list of source traffic selectors
         * @param dst_ts                list of destination traffic selectors
         * @return                              SUCCESS if operation completed
@@ -112,8 +113,8 @@ struct kernel_ipsec_t {
                                                u_int16_t enc_alg, chunk_t enc_key,
                                                u_int16_t int_alg, chunk_t int_key,
                                                ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
-                                               u_int32_t replay_window,
-                                               bool initiator, bool encap, bool esn, bool inbound,
+                                               u_int32_t replay_window, bool initiator, bool encap,
+                                               bool esn, bool inbound, bool update,
                                                linked_list_t *src_ts, linked_list_t *dst_ts);
 
        /**

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
index b4875ba580069312e1bde6060e01b9b371bffd1d..9534ef0c0de4bcdc71e6f7e48661593a1237fcb5 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -1197,7 +1197,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t* src_ts, linked_list_t* dst_ts)
 {
        netlink_buf_t request;
@@ -1217,7 +1217,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
                add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, mark,
                           tfc, &lft, ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED,
                           chunk_empty, mode, ipcomp, 0, 0, initiator, FALSE, FALSE,
-                          inbound, src_ts, dst_ts);
+                          inbound, update, src_ts, dst_ts);
                ipcomp = IPCOMP_NONE;
                /* use transport mode ESP SA, IPComp uses tunnel mode */
                mode = MODE_TRANSPORT;
@@ -1230,7 +1230,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
 
        hdr = &request.hdr;
        hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
-       hdr->nlmsg_type = inbound ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
+       hdr->nlmsg_type = update ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
        hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
 
        sa = NLMSG_DATA(hdr);

diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
index 423b57e318d99483727481e2a6ccc32383b0a5fa..3b32ba553aeca02086bf6a983bc1f542e4cd9ba1 100644 (file)
--- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
@@ -1615,7 +1615,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        unsigned char request[PFKEY_BUFFER_SIZE];
@@ -1634,13 +1634,13 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
                add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, mark,
                           tfc, &lft, ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED,
                           chunk_empty, mode, ipcomp, 0, 0, FALSE, FALSE, FALSE, inbound,
-                          NULL, NULL);
+                          update, NULL, NULL);
                ipcomp = IPCOMP_NONE;
                /* use transport mode ESP SA, IPComp uses tunnel mode */
                mode = MODE_TRANSPORT;
        }
 
-       if (inbound)
+       if (update)
        {
                /* As we didn't know the reqid during SPI allocation, we used reqid
                 * zero. Unfortunately we can't SADB_UPDATE to the new reqid, hence we