denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-libipsec: Add support to send/receive raw ESP packets

Browse Source 
This is currently only supported on Linux and with the appropriate
permissions.

Since it's experimental, it's disabled by default.

The log messages for each sent and received ESP message are logged in NET
like the ones in the socket-default plugin for UDP-encapsulated messages.
This commit is contained in:
Tobias Brunner
2023-05-23 13:19:47 +02:00
parent 29e8cb3f90
commit e306fa5f73
7 changed files with 469 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_libipsec/kernel_libipsec_router.c
+22 -4
View File
@@ -18,6 +18,7 @@
#include <fcntl.h>
#include "kernel_libipsec_router.h"
#include "kernel_libipsec_esp_handler.h"
#include <daemon.h>
#include <ipsec.h>
@@ -76,6 +77,11 @@ struct private_kernel_libipsec_router_t {
* Pipe to signal handle_plain() about changes regarding TUN devices
*/
int notify[2];
/**
* ESP handler to send raw ESP packets
*/
kernel_libipsec_esp_handler_t *esp_handler;
};
/**
@@ -95,9 +101,20 @@ static bool tun_entry_equals(tun_entry_t *a, tun_entry_t *b)
}
CALLBACK(send_esp, void,
void *data, esp_packet_t *packet, bool encap)
private_kernel_libipsec_router_t *this, esp_packet_t *packet, bool encap)
{
charon->sender->send_no_marker(charon->sender, (packet_t*)packet);
if (encap)
{
charon->sender->send_no_marker(charon->sender, (packet_t*)packet);
}
else if (this->esp_handler)
{
this->esp_handler->send(this->esp_handler, packet);
}
else
{ /* shouldn't happen as UDP encap is forced without ESP handler */
packet->destroy(packet);
}
}
CALLBACK(receiver_esp_cb, void,
@@ -323,7 +340,8 @@ kernel_libipsec_router_t *kernel_libipsec_router_create()
},
.tun = {
.tun = lib->get(lib, "kernel-libipsec-tun"),
}
},
.esp_handler = lib->get(lib, "kernel-libipsec-esp-handler"),
);
if (pipe(this->notify) != 0 ||
@@ -341,7 +359,7 @@ kernel_libipsec_router_t *kernel_libipsec_router_create()
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
charon->kernel->add_listener(charon->kernel, &this->public.listener);
ipsec->processor->register_outbound(ipsec->processor, send_esp, NULL);
ipsec->processor->register_outbound(ipsec->processor, send_esp, this);
ipsec->processor->register_inbound(ipsec->processor, deliver_plain, this);
charon->receiver->add_esp_cb(charon->receiver, receiver_esp_cb, NULL);
lib->processor->queue_job(lib->processor,