libipsec: Pass separate inbound/update flags to the IPsec SA manager
authorMartin Willi <martin@revosec.ch>
Mon, 9 Mar 2015 17:08:52 +0000 (18:08 +0100)
committerMartin Willi <martin@revosec.ch>
Mon, 9 Mar 2015 17:18:20 +0000 (18:18 +0100)
Similar to other kernel interfaces, the libipsec backends uses the flag for
different purposes, and therefore should get separate flags.

src/frontends/android/jni/libandroidbridge/kernel/android_ipsec.c
src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
src/libipsec/ipsec_sa_mgr.c
src/libipsec/ipsec_sa_mgr.h

index a0aefaa..29099d4 100644 (file)
@@ -66,12 +66,13 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
        u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
        u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
-       bool initiator, bool encap, bool esn, bool inbound,
+       bool initiator, bool encap, bool esn, bool inbound, bool update,
        linked_list_t *src_ts, linked_list_t *dst_ts)
 {
        return ipsec->sas->add_sa(ipsec->sas, src, dst, spi, protocol, reqid, mark,
                                                          tfc, lifetime, enc_alg, enc_key, int_alg, int_key,
-                                                         mode, ipcomp, cpi, initiator, encap, esn, inbound);
+                                                         mode, ipcomp, cpi, initiator, encap, esn,
+                                                         inbound, update);
 }
 
 METHOD(kernel_ipsec_t, update_sa, status_t,
index eabcb93..6246dc5 100644 (file)
@@ -259,7 +259,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
 {
        return ipsec->sas->add_sa(ipsec->sas, src, dst, spi, protocol, reqid, mark,
                                                          tfc, lifetime, enc_alg, enc_key, int_alg, int_key,
-                                                         mode, ipcomp, cpi, initiator, encap, esn, inbound);
+                                                         mode, ipcomp, cpi, initiator, encap, esn,
+                                                         inbound, update);
 }
 
 METHOD(kernel_ipsec_t, update_sa, status_t,
index 3496fc7..07ffa9e 100644 (file)
@@ -439,7 +439,8 @@ METHOD(ipsec_sa_mgr_t, add_sa, status_t,
        u_int8_t protocol, u_int32_t reqid,     mark_t mark, u_int32_t tfc,
        lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
        u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode, u_int16_t ipcomp,
-       u_int16_t cpi, bool initiator, bool encap, bool esn, bool inbound)
+       u_int16_t cpi, bool initiator, bool encap, bool esn, bool inbound,
+       bool update)
 {
        ipsec_sa_entry_t *entry;
        ipsec_sa_t *sa_new;
@@ -462,7 +463,7 @@ METHOD(ipsec_sa_mgr_t, add_sa, status_t,
 
        this->mutex->lock(this->mutex);
 
-       if (inbound)
+       if (update)
        {       /* remove any pre-allocated SPIs */
                u_int32_t *spi_alloc;
 
index 8d3f64f..a57eab4 100644 (file)
@@ -73,6 +73,7 @@ struct ipsec_sa_mgr_t {
         * @param encap                 enable UDP encapsulation (must be TRUE)
         * @param esn                   Extended Sequence Numbers (currently not supported)
         * @param inbound               TRUE if this is an inbound SA, FALSE otherwise
+        * @param update                TRUE if an SPI has already been allocated for SA
         * @return                              SUCCESS if operation completed
         */
        status_t (*add_sa)(ipsec_sa_mgr_t *this, host_t *src, host_t *dst,
@@ -81,7 +82,7 @@ struct ipsec_sa_mgr_t {
                                           u_int16_t enc_alg, chunk_t enc_key, u_int16_t int_alg,
                                           chunk_t int_key, ipsec_mode_t mode, u_int16_t ipcomp,
                                           u_int16_t cpi, bool initiator, bool encap, bool esn,
-                                          bool inbound);
+                                          bool inbound, bool update);
 
        /**
         * Update the hosts on an installed SA.