summaryrefslogtreecommitdiffstats
path: root/extras/strongswan
diff options
context:
space:
mode:
authorGabriel Oginski <gabrielx.oginski@intel.com>2023-09-14 09:03:36 +0000
committerGabriel Oginski <gabrielx.oginski@intel.com>2023-09-15 11:19:16 +0200
commit052b0234885be89e721d5b559faa11fa6c47502a (patch)
tree017a61bb8469605385f0ce7c1f9eef990ba168fe /extras/strongswan
parent5b3e04c74f188dbe6c4edab57e555ee3a01fb8f7 (diff)
vpp-swan: fix configuration of policies
This patch fixes configuration of priority, port and type of protocol for inbound and outbound policies in policy-based IPsec of this plugin. Type: fix Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I01ddc2e13ebbe87380e66a525aac1b615f619604
Diffstat (limited to 'extras/strongswan')
-rw-r--r--extras/strongswan/vpp_sswan/kernel_vpp_ipsec.c31
1 files changed, 16 insertions, 15 deletions
diff --git a/extras/strongswan/vpp_sswan/kernel_vpp_ipsec.c b/extras/strongswan/vpp_sswan/kernel_vpp_ipsec.c
index 325a3d13c91..e1c71edc836 100644
--- a/extras/strongswan/vpp_sswan/kernel_vpp_ipsec.c
+++ b/extras/strongswan/vpp_sswan/kernel_vpp_ipsec.c
@@ -789,7 +789,7 @@ error:
}
static int
-bypass_all (bool add, uint32_t spd_id, uint32_t sa_id)
+bypass_all (bool add, uint32_t spd_id, uint32_t sa_id, uint32_t priority)
{
vl_api_ipsec_spd_entry_add_del_t *mp;
vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
@@ -809,7 +809,7 @@ bypass_all (bool add, uint32_t spd_id, uint32_t sa_id)
mp->is_add = add;
mp->entry.sa_id = ntohl (sa_id);
mp->entry.spd_id = ntohl (spd_id);
- mp->entry.priority = ntohl (INT_MAX - POLICY_PRIORITY_PASS - 1);
+ mp->entry.priority = ntohl (priority - POLICY_PRIORITY_PASS);
mp->entry.is_outbound = 0;
mp->entry.policy = ntohl (IPSEC_API_SPD_ACTION_BYPASS);
memset (mp->entry.local_address_stop.un.ip6, 0xFF, 16);
@@ -899,7 +899,8 @@ error:
}
static int
-bypass_port (bool add, uint32_t spd_id, uint32_t sa_id, uint16_t port)
+bypass_port (bool add, uint32_t spd_id, uint32_t sa_id, uint16_t port,
+ uint32_t priority)
{
vl_api_ipsec_spd_entry_add_del_t *mp;
vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
@@ -916,14 +917,14 @@ bypass_port (bool add, uint32_t spd_id, uint32_t sa_id, uint16_t port)
mp->is_add = add;
mp->entry.sa_id = ntohl (sa_id);
mp->entry.spd_id = ntohl (spd_id);
- mp->entry.priority = ntohl (INT_MAX - POLICY_PRIORITY_PASS - 1);
+ mp->entry.priority = ntohl (priority - POLICY_PRIORITY_PASS);
mp->entry.policy = ntohl (IPSEC_API_SPD_ACTION_BYPASS);
memset (mp->entry.local_address_stop.un.ip6, 0xFF, 16);
memset (mp->entry.remote_address_stop.un.ip6, 0xFF, 16);
mp->entry.is_outbound = 0;
- mp->entry.remote_port_start = mp->entry.local_port_start = ntohs (0);
- mp->entry.remote_port_stop = mp->entry.local_port_stop = ntohs (0xFFFF);
- mp->entry.protocol = IP_API_PROTO_HOPOPT;
+ mp->entry.remote_port_start = mp->entry.local_port_start = ntohs (port);
+ mp->entry.remote_port_stop = mp->entry.local_port_stop = ntohs (port);
+ mp->entry.protocol = IP_API_PROTO_UDP;
if (vac->send (vac, (char *) mp, sizeof (*mp), &out, &out_len))
{
@@ -970,19 +971,19 @@ error:
* Add or remove a bypass policy
*/
static status_t
-manage_bypass (bool add, uint32_t spd_id, uint32_t sa_id)
+manage_bypass (bool add, uint32_t spd_id, uint32_t sa_id, uint32_t priority)
{
uint16_t port;
status_t rv;
- bypass_all (add, spd_id, sa_id);
+ bypass_all (add, spd_id, sa_id, priority);
port =
lib->settings->get_int (lib->settings, "%s.port", IKEV2_UDP_PORT, lib->ns);
if (port)
{
- rv = bypass_port (add, spd_id, sa_id, port);
+ rv = bypass_port (add, spd_id, sa_id, port, priority);
if (rv != SUCCESS)
{
return rv;
@@ -993,7 +994,7 @@ manage_bypass (bool add, uint32_t spd_id, uint32_t sa_id)
IKEV2_NATT_PORT, lib->ns);
if (port)
{
- rv = bypass_port (add, spd_id, sa_id, port);
+ rv = bypass_port (add, spd_id, sa_id, port, priority);
if (rv != SUCCESS)
{
return rv;
@@ -1021,7 +1022,7 @@ manage_policy (private_kernel_vpp_ipsec_t *this, bool add,
host_t *src = NULL, *dst = NULL, *addr = NULL;
vl_api_ipsec_spd_entry_add_del_t *mp = NULL;
vl_api_ipsec_spd_entry_add_del_reply_t *rmp = NULL;
- bool n_spd = false;
+ bool n_spd = false; /* is a new SPD? */
vl_api_ipsec_spd_dump_t *mp_dump = NULL;
vl_api_ipsec_spd_details_t *rmp_dump = NULL, *tmp = NULL;
@@ -1101,7 +1102,7 @@ manage_policy (private_kernel_vpp_ipsec_t *this, bool add,
mp->_vl_msg_id = htons (msg_id);
mp->is_add = add;
mp->entry.spd_id = htonl (spd->spd_id);
- mp->entry.priority = htonl (INT_MAX - POLICY_PRIORITY_PASS);
+ mp->entry.priority = htonl (priority - POLICY_PRIORITY_DEFAULT);
mp->entry.is_outbound = id->dir == POLICY_OUT;
switch (data->type)
{
@@ -1133,7 +1134,7 @@ manage_policy (private_kernel_vpp_ipsec_t *this, bool add,
sad_id = sa->sa_id;
if (n_spd)
{
- if (manage_bypass (TRUE, spd_id, ~0))
+ if (manage_bypass (TRUE, spd_id, ~0, priority))
{
DBG1 (DBG_KNL, "manage_bypass %d failed!!!!", spd_id);
goto error;
@@ -1272,7 +1273,7 @@ next:
"policy_num's ref is 0, delete spd_id %d sw_if_index %d sad_id %x",
spd->spd_id, spd->sw_if_index, sad_id);
interface_add_del_spd (FALSE, spd->spd_id, spd->sw_if_index);
- manage_bypass (FALSE, spd->spd_id, sad_id);
+ manage_bypass (FALSE, spd->spd_id, sad_id, priority);
spd_add_del (FALSE, spd->spd_id);
this->spds->remove (this->spds, interface);
if (spd->if_name)