sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-04 00:00:14 -04:00
Code Issues Projects Releases Wiki Activity

child-sa: Cache and forward actual initiator flag for outbound SA

Browse Source 
Kernel interfaces (e.g. TKM) might rely on this flag to be correct.
This commit is contained in:
Tobias Brunner 2020-08-18 09:40:17 +02:00
parent 8d6ed71a55
commit 639af09b2e
3 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/libcharon/sa/child_sa.c
View File

@ -110,6 +110,11 @@ struct private_child_sa_t {
*/
chunk_t integ_r;
/**
* Whether the registered outbound SA was created as initiator
*/
bool initiator;
/**
* Whether the outbound SA has only been registered yet during a rekeying
*/
@ -1420,13 +1425,13 @@ static bool install_outbound_immediately(private_child_sa_t *this)
METHOD(child_sa_t, register_outbound, status_t,
private_child_sa_t *this, chunk_t encr, chunk_t integ, uint32_t spi,
uint16_t cpi, bool tfcv3)
uint16_t cpi, bool initiator, bool tfcv3)
{
status_t status;
if (install_outbound_immediately(this))
{
status = install_internal(this, encr, integ, spi, cpi, FALSE, FALSE,
status = install_internal(this, encr, integ, spi, cpi, initiator, FALSE,
tfcv3);
}
else
@ -1440,6 +1445,7 @@ METHOD(child_sa_t, register_outbound, status_t,
this->other_cpi = cpi;
this->encr_r = chunk_clone(encr);
this->integ_r = chunk_clone(integ);
this->initiator = initiator;
this->tfcv3 = tfcv3;
status = SUCCESS;
}
@ -1457,8 +1463,8 @@ METHOD(child_sa_t, install_outbound, status_t,
if (!(this->outbound_state & CHILD_OUTBOUND_SA))
{
status = install_internal(this, this->encr_r, this->integ_r,
this->other_spi, this->other_cpi, FALSE,
FALSE, this->tfcv3);
this->other_spi, this->other_cpi,
this->initiator, FALSE, this->tfcv3);
chunk_clear(&this->encr_r);
chunk_clear(&this->integ_r);
}

4
src/libcharon/sa/child_sa.h
View File

@ -442,11 +442,13 @@ struct child_sa_t {
* @param integ integrity key (cloned)
* @param spi SPI to use, allocated for inbound
* @param cpi CPI to use, allocated for outbound
* @param initiator TRUE if initiator of exchange resulting in this SA
* @param tfcv3 TRUE if peer supports ESPv3 TFC
* @return SUCCESS or FAILED
*/
status_t (*register_outbound)(child_sa_t *this, chunk_t encr, chunk_t integ,
uint32_t spi, uint16_t cpi, bool tfcv3);
uint32_t spi, uint16_t cpi, bool initiator,
bool tfcv3);
/**
* Install the outbound policies and, if not already done, the outbound SA

4
src/libcharon/sa/ikev2/tasks/child_create.c
View File

@ -715,13 +715,13 @@ static status_t select_and_install(private_child_create_t *this,
{
status_o = this->child_sa->register_outbound(this->child_sa,
encr_i, integ_i, this->other_spi, this->other_cpi,
this->tfcv3);
this->initiator, this->tfcv3);
}
else
{
status_o = this->child_sa->register_outbound(this->child_sa,
encr_r, integ_r, this->other_spi, this->other_cpi,
this->tfcv3);
this->initiator, this->tfcv3);
}
}
else if (this->initiator)