Merge branch 'tfc-notify'
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if kernel does not support it.
This commit is contained in:
commit
d634109f1d
6 changed files with 68 additions and 2 deletions
|
@ -18,6 +18,7 @@
|
||||||
#include "child_create.h"
|
#include "child_create.h"
|
||||||
|
|
||||||
#include <daemon.h>
|
#include <daemon.h>
|
||||||
|
#include <hydra.h>
|
||||||
#include <sa/ikev2/keymat_v2.h>
|
#include <sa/ikev2/keymat_v2.h>
|
||||||
#include <crypto/diffie_hellman.h>
|
#include <crypto/diffie_hellman.h>
|
||||||
#include <credentials/certificates/x509.h>
|
#include <credentials/certificates/x509.h>
|
||||||
|
@ -615,6 +616,7 @@ static void build_payloads(private_child_create_t *this, message_t *message)
|
||||||
nonce_payload_t *nonce_payload;
|
nonce_payload_t *nonce_payload;
|
||||||
ke_payload_t *ke_payload;
|
ke_payload_t *ke_payload;
|
||||||
ts_payload_t *ts_payload;
|
ts_payload_t *ts_payload;
|
||||||
|
kernel_feature_t features;
|
||||||
|
|
||||||
/* add SA payload */
|
/* add SA payload */
|
||||||
if (this->initiator)
|
if (this->initiator)
|
||||||
|
@ -661,6 +663,13 @@ static void build_payloads(private_child_create_t *this, message_t *message)
|
||||||
default:
|
default:
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
features = hydra->kernel_interface->get_features(hydra->kernel_interface);
|
||||||
|
if (!(features & KERNEL_ESP_V3_TFC))
|
||||||
|
{
|
||||||
|
message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED,
|
||||||
|
chunk_empty);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
|
@ -137,6 +137,22 @@ struct private_kernel_interface_t {
|
||||||
bool ifaces_exclude;
|
bool ifaces_exclude;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
METHOD(kernel_interface_t, get_features, kernel_feature_t,
|
||||||
|
private_kernel_interface_t *this)
|
||||||
|
{
|
||||||
|
kernel_feature_t features = 0;
|
||||||
|
|
||||||
|
if (this->ipsec && this->ipsec->get_features)
|
||||||
|
{
|
||||||
|
features |= this->ipsec->get_features(this->ipsec);
|
||||||
|
}
|
||||||
|
if (this->net && this->net->get_features)
|
||||||
|
{
|
||||||
|
features |= this->net->get_features(this->net);
|
||||||
|
}
|
||||||
|
return features;
|
||||||
|
}
|
||||||
|
|
||||||
METHOD(kernel_interface_t, get_spi, status_t,
|
METHOD(kernel_interface_t, get_spi, status_t,
|
||||||
private_kernel_interface_t *this, host_t *src, host_t *dst,
|
private_kernel_interface_t *this, host_t *src, host_t *dst,
|
||||||
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||||
|
@ -682,6 +698,7 @@ kernel_interface_t *kernel_interface_create()
|
||||||
|
|
||||||
INIT(this,
|
INIT(this,
|
||||||
.public = {
|
.public = {
|
||||||
|
.get_features = _get_features,
|
||||||
.get_spi = _get_spi,
|
.get_spi = _get_spi,
|
||||||
.get_cpi = _get_cpi,
|
.get_cpi = _get_cpi,
|
||||||
.add_sa = _add_sa,
|
.add_sa = _add_sa,
|
||||||
|
@ -757,4 +774,3 @@ kernel_interface_t *kernel_interface_create()
|
||||||
|
|
||||||
return &this->public;
|
return &this->public;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -47,6 +47,7 @@
|
||||||
#define KERNEL_INTERFACE_H_
|
#define KERNEL_INTERFACE_H_
|
||||||
|
|
||||||
typedef struct kernel_interface_t kernel_interface_t;
|
typedef struct kernel_interface_t kernel_interface_t;
|
||||||
|
typedef enum kernel_feature_t kernel_feature_t;
|
||||||
|
|
||||||
#include <networking/host.h>
|
#include <networking/host.h>
|
||||||
#include <crypto/prf_plus.h>
|
#include <crypto/prf_plus.h>
|
||||||
|
@ -55,6 +56,17 @@ typedef struct kernel_interface_t kernel_interface_t;
|
||||||
#include <kernel/kernel_ipsec.h>
|
#include <kernel/kernel_ipsec.h>
|
||||||
#include <kernel/kernel_net.h>
|
#include <kernel/kernel_net.h>
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Bitfield of optional features a kernel backend supports.
|
||||||
|
*
|
||||||
|
* This feature-set is for both, kernel_ipsec_t and kernel_net_t. Each
|
||||||
|
* backend returns a subset of these features.
|
||||||
|
*/
|
||||||
|
enum kernel_feature_t {
|
||||||
|
/** IPsec can process ESPv3 (RFC 4303) TFC padded packets */
|
||||||
|
KERNEL_ESP_V3_TFC = (1<<0),
|
||||||
|
};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Constructor function for ipsec kernel interface
|
* Constructor function for ipsec kernel interface
|
||||||
*/
|
*/
|
||||||
|
@ -73,6 +85,13 @@ typedef kernel_net_t* (*kernel_net_constructor_t)(void);
|
||||||
*/
|
*/
|
||||||
struct kernel_interface_t {
|
struct kernel_interface_t {
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get the feature set supported by the net and ipsec kernel backends.
|
||||||
|
*
|
||||||
|
* @return ORed feature-set of backends
|
||||||
|
*/
|
||||||
|
kernel_feature_t (*get_features)(kernel_interface_t *this);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Get a SPI from the kernel.
|
* Get a SPI from the kernel.
|
||||||
*
|
*
|
||||||
|
|
|
@ -30,6 +30,7 @@ typedef struct kernel_ipsec_t kernel_ipsec_t;
|
||||||
#include <ipsec/ipsec_types.h>
|
#include <ipsec/ipsec_types.h>
|
||||||
#include <selectors/traffic_selector.h>
|
#include <selectors/traffic_selector.h>
|
||||||
#include <plugins/plugin.h>
|
#include <plugins/plugin.h>
|
||||||
|
#include <kernel/kernel_interface.h>
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Interface to the ipsec subsystem of the kernel.
|
* Interface to the ipsec subsystem of the kernel.
|
||||||
|
@ -44,6 +45,13 @@ typedef struct kernel_ipsec_t kernel_ipsec_t;
|
||||||
*/
|
*/
|
||||||
struct kernel_ipsec_t {
|
struct kernel_ipsec_t {
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get the feature set supported by this kernel backend.
|
||||||
|
*
|
||||||
|
* @return ORed feature-set of backend
|
||||||
|
*/
|
||||||
|
kernel_feature_t (*get_features)(kernel_ipsec_t *this);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Get a SPI from the kernel.
|
* Get a SPI from the kernel.
|
||||||
*
|
*
|
||||||
|
|
|
@ -28,6 +28,7 @@ typedef enum kernel_address_type_t kernel_address_type_t;
|
||||||
#include <collections/enumerator.h>
|
#include <collections/enumerator.h>
|
||||||
#include <networking/host.h>
|
#include <networking/host.h>
|
||||||
#include <plugins/plugin.h>
|
#include <plugins/plugin.h>
|
||||||
|
#include <kernel/kernel_interface.h>
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Type of addresses (e.g. when enumerating them)
|
* Type of addresses (e.g. when enumerating them)
|
||||||
|
@ -55,6 +56,13 @@ enum kernel_address_type_t {
|
||||||
*/
|
*/
|
||||||
struct kernel_net_t {
|
struct kernel_net_t {
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Get the feature set supported by this kernel backend.
|
||||||
|
*
|
||||||
|
* @return ORed feature-set of backend
|
||||||
|
*/
|
||||||
|
kernel_feature_t (*get_features)(kernel_net_t *this);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Get our outgoing source address for a destination.
|
* Get our outgoing source address for a destination.
|
||||||
*
|
*
|
||||||
|
|
|
@ -1036,6 +1036,12 @@ static job_requeue_t receive_events(private_kernel_netlink_ipsec_t *this)
|
||||||
return JOB_REQUEUE_DIRECT;
|
return JOB_REQUEUE_DIRECT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
|
||||||
|
private_kernel_netlink_ipsec_t *this)
|
||||||
|
{
|
||||||
|
return KERNEL_ESP_V3_TFC;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Get an SPI for a specific protocol from the kernel.
|
* Get an SPI for a specific protocol from the kernel.
|
||||||
*/
|
*/
|
||||||
|
@ -2734,6 +2740,7 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
|
||||||
INIT(this,
|
INIT(this,
|
||||||
.public = {
|
.public = {
|
||||||
.interface = {
|
.interface = {
|
||||||
|
.get_features = _get_features,
|
||||||
.get_spi = _get_spi,
|
.get_spi = _get_spi,
|
||||||
.get_cpi = _get_cpi,
|
.get_cpi = _get_cpi,
|
||||||
.add_sa = _add_sa,
|
.add_sa = _add_sa,
|
||||||
|
@ -2822,4 +2829,3 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
|
||||||
|
|
||||||
return &this->public;
|
return &this->public;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue