Class representing an IPsec policy added
authorTobias Brunner <tobias@strongswan.org>
Fri, 13 Jul 2012 12:05:52 +0000 (14:05 +0200)
committerTobias Brunner <tobias@strongswan.org>
Wed, 8 Aug 2012 13:41:03 +0000 (15:41 +0200)
src/libipsec/Android.mk
src/libipsec/Makefile.am
src/libipsec/ipsec_policy.c [new file with mode: 0644]
src/libipsec/ipsec_policy.h [new file with mode: 0644]

index 0248109..f18fc73 100644 (file)
@@ -8,6 +8,7 @@ esp_context.c esp_context.h \
 esp_packet.c esp_packet.h \
 ipsec_event_listener.h \
 ipsec_event_relay.c ipsec_event_relay.h \
+ipsec_policy.c ipsec_policy.h \
 ipsec_sa.c ipsec_sa.h \
 ipsec_sa_mgr.c ipsec_sa_mgr.h
 
index c102493..4b81d45 100644 (file)
@@ -6,6 +6,7 @@ esp_context.c esp_context.h \
 esp_packet.c esp_packet.h \
 ipsec_event_listener.h \
 ipsec_event_relay.c ipsec_event_relay.h \
+ipsec_policy.c ipsec_policy.h \
 ipsec_sa.c ipsec_sa.h \
 ipsec_sa_mgr.c ipsec_sa_mgr.h
 
diff --git a/src/libipsec/ipsec_policy.c b/src/libipsec/ipsec_policy.c
new file mode 100644 (file)
index 0000000..e0e154b
--- /dev/null
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2012 Tobias Brunner
+ * Copyright (C) 2012 Giuliano Grassi
+ * Copyright (C) 2012 Ralf Sager
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ipsec_policy.h"
+
+#include <debug.h>
+
+typedef struct private_ipsec_policy_t private_ipsec_policy_t;
+
+/**
+ * Private additions to ipsec_policy_t.
+ */
+struct private_ipsec_policy_t {
+
+       /**
+        * Public members
+        */
+       ipsec_policy_t public;
+
+       /**
+        * SA source address
+        */
+       host_t *src;
+
+       /**
+        * SA destination address
+        */
+       host_t *dst;
+
+       /**
+        * Source traffic selector
+        */
+       traffic_selector_t *src_ts;
+
+       /**
+        * Destination traffic selector
+        */
+       traffic_selector_t *dst_ts;
+
+       /**
+        * If any of the two TS has a protocol selector we cache it here
+        */
+       u_int8_t protocol;
+
+       /**
+        * Traffic direction
+        */
+       policy_dir_t direction;
+
+       /**
+        * Policy type
+        */
+       policy_type_t type;
+
+       /**
+        * SA configuration
+        */
+       ipsec_sa_cfg_t sa;
+
+       /**
+        * Mark
+        */
+       mark_t mark;
+
+       /**
+        * Policy priority
+        */
+       policy_priority_t priority;
+
+       /**
+        * Reference counter
+        */
+       refcount_t refcount;
+
+};
+
+METHOD(ipsec_policy_t, get_source_ts, traffic_selector_t*,
+       private_ipsec_policy_t *this)
+{
+       return this->src_ts;
+}
+
+METHOD(ipsec_policy_t, get_destination_ts, traffic_selector_t*,
+       private_ipsec_policy_t *this)
+{
+       return this->dst_ts;
+}
+
+METHOD(ipsec_policy_t, get_reqid, u_int32_t,
+       private_ipsec_policy_t *this)
+{
+       return this->sa.reqid;
+}
+
+METHOD(ipsec_policy_t, get_direction, policy_dir_t,
+       private_ipsec_policy_t *this)
+{
+       return this->direction;
+}
+
+METHOD(ipsec_policy_t, get_priority, policy_priority_t,
+       private_ipsec_policy_t *this)
+{
+       return this->priority;
+}
+
+METHOD(ipsec_policy_t, get_type, policy_type_t,
+       private_ipsec_policy_t *this)
+{
+       return this->type;
+}
+
+METHOD(ipsec_policy_t, get_ref, ipsec_policy_t*,
+       private_ipsec_policy_t *this)
+{
+       ref_get(&this->refcount);
+       return &this->public;
+}
+
+METHOD(ipsec_policy_t, destroy, void,
+               private_ipsec_policy_t *this)
+{
+       if (ref_put(&this->refcount))
+       {
+               this->src->destroy(this->src);
+               this->dst->destroy(this->dst);
+               this->src_ts->destroy(this->src_ts);
+               this->dst_ts->destroy(this->dst_ts);
+               free(this);
+       }
+}
+
+/**
+ * Described in header.
+ */
+ipsec_policy_t *ipsec_policy_create(host_t *src, host_t *dst,
+                                                                       traffic_selector_t *src_ts,
+                                                                       traffic_selector_t *dst_ts,
+                                                                       policy_dir_t direction, policy_type_t type,
+                                                                       ipsec_sa_cfg_t *sa, mark_t mark,
+                                                                       policy_priority_t priority)
+{
+       private_ipsec_policy_t *this;
+
+       INIT(this,
+               .public = {
+                       .get_source_ts = _get_source_ts,
+                       .get_destination_ts = _get_destination_ts,
+                       .get_direction = _get_direction,
+                       .get_priority = _get_priority,
+                       .get_reqid = _get_reqid,
+                       .get_type = _get_type,
+                       .get_ref = _get_ref,
+                       .destroy = _destroy,
+               },
+               .src = src->clone(src),
+               .dst = dst->clone(dst),
+               .src_ts = src_ts->clone(src_ts),
+               .dst_ts = dst_ts->clone(dst_ts),
+               .protocol = max(src_ts->get_protocol(src_ts),
+                                               dst_ts->get_protocol(dst_ts)),
+               .direction = direction,
+               .type = type,
+               .sa = *sa,
+               .mark = mark,
+               .priority = priority,
+               .refcount = 1,
+       );
+
+       return &this->public;
+}
diff --git a/src/libipsec/ipsec_policy.h b/src/libipsec/ipsec_policy.h
new file mode 100644 (file)
index 0000000..0f65b18
--- /dev/null
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012 Tobias Brunner
+ * Copyright (C) 2012 Giuliano Grassi
+ * Copyright (C) 2012 Ralf Sager
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ipsec_policy ipsec_policy
+ * @{ @ingroup libipsec
+ */
+
+#ifndef IPSEC_POLICY_H
+#define IPSEC_POLICY_H
+
+#include <library.h>
+#include <utils/host.h>
+#include <ipsec/ipsec_types.h>
+#include <selectors/traffic_selector.h>
+
+typedef struct ipsec_policy_t ipsec_policy_t;
+
+/**
+ * IPsec Policy
+ */
+struct ipsec_policy_t {
+
+       /**
+        * Get the source traffic selector of this policy
+        *
+        * @return                      the source traffic selector
+        */
+       traffic_selector_t *(*get_source_ts)(ipsec_policy_t *this);
+
+       /**
+        * Get the destination traffic selector of this policy
+        *
+        * @return                      the destination traffic selector
+        */
+       traffic_selector_t *(*get_destination_ts)(ipsec_policy_t *this);
+
+       /**
+        * Get the direction of this policy
+        *
+        * @return                      direction
+        */
+       policy_dir_t (*get_direction)(ipsec_policy_t *this);
+
+       /**
+        * Get the priority of this policy
+        *
+        * @return                      priority
+        */
+       policy_priority_t (*get_priority)(ipsec_policy_t *this);
+
+       /**
+        * Get the type of this policy (e.g. IPsec)
+        *
+        * @return                      the policy type
+        */
+       policy_type_t (*get_type)(ipsec_policy_t *this);
+
+       /**
+        * Get the reqid associated to this policy
+        *
+        * @return                      the reqid
+        */
+       u_int32_t (*get_reqid)(ipsec_policy_t *this);
+
+       /**
+        * Get another reference to this policy
+        *
+        * @return                      additional reference to the policy
+        */
+       ipsec_policy_t *(*get_ref)(ipsec_policy_t *this);
+
+       /**
+        * Destroy an ipsec_policy_t
+        */
+       void (*destroy)(ipsec_policy_t *this);
+
+};
+
+/**
+ * Create an ipsec_policy_t instance
+ *
+ * @param src                  source address of SA
+ * @param dst                  dest address of SA
+ * @param src_ts               traffic selector to match traffic source
+ * @param dst_ts               traffic selector to match traffic dest
+ * @param direction            direction of traffic, POLICY_(IN|OUT|FWD)
+ * @param type                 type of policy, POLICY_(IPSEC|PASS|DROP)
+ * @param sa                   details about the SA(s) tied to this policy
+ * @param mark                 mark for this policy
+ * @param priority             priority of this policy
+ * @return                             ipsec policy instance
+ */
+ipsec_policy_t *ipsec_policy_create(host_t *src, host_t *dst,
+                                                                       traffic_selector_t *src_ts,
+                                                                       traffic_selector_t *dst_ts,
+                                                                       policy_dir_t direction, policy_type_t type,
+                                                                       ipsec_sa_cfg_t *sa, mark_t mark,
+                                                                       policy_priority_t priority);
+
+#endif /** IPSEC_POLICY_H @}*/