mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-09 18:45:54 +02:00
IPSec-Downgrade auf 2.4.8-STABLE
Outgoing-Firewall quasi fertig gemacht. IPP2P gefixt. git-svn-id: http://svn.ipfire.org/svn/ipfire/trunk@614 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8
This commit is contained in:
ms
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Automatically generated make config: don't edit
|
||||
# Linux kernel version: 2.6.16.50-ipfire
|
||||
# Fri Jun 1 22:33:07 2007
|
||||
# Wed Jun 6 00:04:48 2007
|
||||
#
|
||||
CONFIG_X86_32=y
|
||||
CONFIG_SEMAPHORE_SLEEPERS=y
|
||||
@@ -620,6 +620,7 @@ CONFIG_KLIPS_ENC_CRYPTOAPI=y
|
||||
CONFIG_KLIPS_ENC_1DES=y
|
||||
CONFIG_KLIPS_ENC_3DES=y
|
||||
CONFIG_KLIPS_ENC_AES=y
|
||||
# CONFIG_KLIPS_ENC_NULL is not set
|
||||
CONFIG_KLIPS_IPCOMP=y
|
||||
CONFIG_KLIPS_DEBUG=y
|
||||
|
||||
|
||||
@@ -626,6 +626,7 @@ CONFIG_KLIPS_ENC_CRYPTOAPI=y
|
||||
CONFIG_KLIPS_ENC_1DES=y
|
||||
CONFIG_KLIPS_ENC_3DES=y
|
||||
CONFIG_KLIPS_ENC_AES=y
|
||||
# CONFIG_KLIPS_ENC_NULL is not set
|
||||
CONFIG_KLIPS_IPCOMP=y
|
||||
CONFIG_KLIPS_DEBUG=y
|
||||
|
||||
|
||||
@@ -504,6 +504,7 @@ CONFIG_KLIPS_ENC_CRYPTOAPI=y
|
||||
CONFIG_KLIPS_ENC_1DES=y
|
||||
CONFIG_KLIPS_ENC_3DES=y
|
||||
CONFIG_KLIPS_ENC_AES=y
|
||||
# CONFIG_KLIPS_ENC_NULL is not set
|
||||
CONFIG_KLIPS_IPCOMP=y
|
||||
CONFIG_KLIPS_DEBUG=y
|
||||
|
||||
|
||||
@@ -6,6 +6,9 @@
|
||||
#
|
||||
# (c) The IPFire Team
|
||||
#
|
||||
# Michael Tremer - mitch@ipfire.org
|
||||
# Christian Schmidt - maniacikarus@ipfire.org
|
||||
#
|
||||
|
||||
use strict;
|
||||
# enable only the following on debugging purpose
|
||||
@@ -24,8 +27,10 @@ my @configline = ();
|
||||
my $p2pentry = "";
|
||||
my @p2ps = ();
|
||||
my @p2pline = ();
|
||||
my @protos = ();
|
||||
my @proto = ();
|
||||
my $CMD = "";
|
||||
my $P2PSTRING = "";
|
||||
|
||||
my $DEBUG = 0;
|
||||
|
||||
my $configfile = "/var/ipfire/outgoing/rules";
|
||||
@@ -68,21 +73,10 @@ open( FILE, "< $configfile" ) or die "Unable to read $configfile";
|
||||
@configs = <FILE>;
|
||||
close FILE;
|
||||
|
||||
# Say hello!
|
||||
print "Outgoing firewall for IPFire - $outfwsettings{'POLICY'}\n";
|
||||
if ($DEBUG) { print "Debugging mode!\n"; }
|
||||
print "\n";
|
||||
|
||||
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE0' ) {
|
||||
system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1");
|
||||
system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1");
|
||||
|
||||
exit 0
|
||||
} elsif ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
|
||||
$outfwsettings{'STATE'} = "ALLOW";
|
||||
$POLICY = "DROP";
|
||||
$DO = "ACCEPT";
|
||||
$DO = "RETURN";
|
||||
} elsif ( $outfwsettings{'POLICY'} eq 'MODE2' ) {
|
||||
$outfwsettings{'STATE'} = "DENY";
|
||||
$POLICY = "ACCEPT";
|
||||
@@ -94,6 +88,17 @@ system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1");
|
||||
system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1");
|
||||
system("/sbin/iptables -N OUTGOINGFW >/dev/null 2>&1");
|
||||
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE0' ) {
|
||||
exit 0
|
||||
}
|
||||
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -m state --state ESTABLISHED,RELATED -j RETURN";
|
||||
if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); }
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -p icmp -j RETURN";
|
||||
if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); }
|
||||
}
|
||||
|
||||
foreach $configentry (sort @configs)
|
||||
{
|
||||
$SOURCE = "";
|
||||
@@ -122,33 +127,85 @@ foreach $configentry (sort @configs)
|
||||
}
|
||||
|
||||
if ($configline[7]) { $DESTINATION = "$configline[7]"; } else { $DESTINATION = "0/0"; }
|
||||
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION";
|
||||
|
||||
if ($configline[3] ne 'tcp&udp') {
|
||||
$PROTO = "$configline[3]";
|
||||
$CMD = "$CMD -p $PROTO";
|
||||
|
||||
if ($configline[3] eq 'tcp') {
|
||||
@proto = ("tcp");
|
||||
} elsif ($configline[3] eq 'udp') {
|
||||
@proto = ("udp");
|
||||
} else {
|
||||
@proto = ("tcp", "udp");
|
||||
}
|
||||
|
||||
foreach $PROTO (@proto) {
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION -p $PROTO";
|
||||
|
||||
if ($configline[8]) {
|
||||
$DPORT = "$configline[8]";
|
||||
$CMD = "$CMD --dport $DPORT";
|
||||
}
|
||||
}
|
||||
|
||||
if ($DEV) {
|
||||
$CMD = "$CMD -i $DEV";
|
||||
}
|
||||
|
||||
if ($configline[6]) {
|
||||
$MAC = "$configline[6]";
|
||||
$CMD = "$CMD -m mac --mac-source $MAC";
|
||||
}
|
||||
|
||||
$CMD = "$CMD -o $netsettings{'RED_DEV'}";
|
||||
if ($DEBUG) { print "$CMD -j $DO\n"; } else { system("$CMD -j $DO"); }
|
||||
|
||||
if ($configline[9] eq "log") {
|
||||
if ($DEBUG) { print "$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '\n"; } else { system("$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '"); }
|
||||
}
|
||||
|
||||
|
||||
if ($DEV) {
|
||||
$CMD = "$CMD -i $DEV";
|
||||
}
|
||||
|
||||
if ($configline[6]) {
|
||||
$MAC = "$configline[6]";
|
||||
$CMD = "$CMD -m mac --mac-source $MAC";
|
||||
}
|
||||
|
||||
$CMD = "$CMD -o $netsettings{'RED_DEV'}";
|
||||
if ($DEBUG) {
|
||||
print "$CMD -j $DO\n";
|
||||
} else {
|
||||
system("$CMD -j $DO");
|
||||
}
|
||||
|
||||
if ($configline[9] eq "log") {
|
||||
if ($DEBUG) {
|
||||
print "$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '\n";
|
||||
} else {
|
||||
system("$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
### Do the P2P-Stuff here
|
||||
open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile";
|
||||
@p2ps = <FILE>;
|
||||
close FILE;
|
||||
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -m ipp2p";
|
||||
|
||||
foreach $p2pentry (sort @p2ps)
|
||||
{
|
||||
@p2pline = split( /\;/, $p2pentry );
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE2' ) {
|
||||
$DO = "DROP";
|
||||
if ("$p2pline[2]" eq "off") {
|
||||
$P2PSTRING = "$P2PSTRING --$p2pline[1]";
|
||||
}
|
||||
} else {
|
||||
$DO = "RETURN";
|
||||
if ("$p2pline[2]" eq "on") {
|
||||
$P2PSTRING = "$P2PSTRING --$p2pline[1]";
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($P2PSTRING) {
|
||||
if ($DEBUG) {
|
||||
print "$CMD $P2PSTRING -j $DO\n";
|
||||
} else {
|
||||
system("$CMD $P2PSTRING -j $DO");
|
||||
}
|
||||
}
|
||||
|
||||
if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
|
||||
$CMD = "/sbin/iptables -A OUTGOINGFW -j DROP";
|
||||
if ($DEBUG) {
|
||||
print "$CMD\n";
|
||||
} else {
|
||||
system("$CMD");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
#lib/modules/2.6.16/kernel/net/ipv4/netfilter/ipt_ipp2p.ko
|
||||
lib/iptables/libipt_ipp2p.o
|
||||
lib/iptables/libipt_ipp2p.so
|
||||
#lib/modules/2.6.16-smp/kernel/net/ipv4/netfilter/ipt_ipp2p.ko
|
||||
|
||||
@@ -7,11 +7,11 @@ usr/local/bin/ipsecctrl
|
||||
usr/local/bin/launch-ether-wake
|
||||
usr/local/bin/logwatch
|
||||
usr/local/bin/openvpnctrl
|
||||
usr/local/bin/outgoingfwctrl
|
||||
usr/local/bin/qosctrl
|
||||
usr/local/bin/rebuildhosts
|
||||
usr/local/bin/redctrl
|
||||
usr/local/bin/monitorTraff
|
||||
#usr/local/bin/restartapplejuice
|
||||
usr/local/bin/snortctrl
|
||||
usr/local/bin/restartssh
|
||||
usr/local/bin/restartsyslogd
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
etc/ipsec.conf
|
||||
#etc/ipsec.d
|
||||
#etc/ipsec.d/aacerts
|
||||
#etc/ipsec.d/cacerts
|
||||
#etc/ipsec.d/certs
|
||||
#etc/ipsec.d/crls
|
||||
etc/ipsec.d/aacerts
|
||||
etc/ipsec.d/cacerts
|
||||
etc/ipsec.d/certs
|
||||
etc/ipsec.d/crls
|
||||
#etc/ipsec.d/examples
|
||||
#etc/ipsec.d/examples/l2tp-cert-orgWIN2KXP.conf
|
||||
#etc/ipsec.d/examples/l2tp-cert.conf
|
||||
@@ -11,16 +11,17 @@ etc/ipsec.conf
|
||||
#etc/ipsec.d/examples/l2tp-psk.conf
|
||||
#etc/ipsec.d/examples/linux-linux.conf
|
||||
#etc/ipsec.d/examples/no_oe.conf
|
||||
#etc/ipsec.d/ocspcerts
|
||||
#etc/ipsec.d/policies
|
||||
#etc/ipsec.d/examples/sysctl.conf
|
||||
etc/ipsec.d/ocspcerts
|
||||
etc/ipsec.d/policies
|
||||
#etc/ipsec.d/policies/block
|
||||
#etc/ipsec.d/policies/clear
|
||||
#etc/ipsec.d/policies/clear-or-private
|
||||
#etc/ipsec.d/policies/private
|
||||
#etc/ipsec.d/policies/private-or-clear
|
||||
#etc/ipsec.d/private
|
||||
etc/ipsec.d/private
|
||||
etc/ipsec.secrets
|
||||
etc/rc.d/init.d/ipsec
|
||||
#etc/rc.d/init.d/ipsec.old
|
||||
#etc/rc.d/rc0.d/K76ipsec
|
||||
#etc/rc.d/rc1.d
|
||||
#etc/rc.d/rc1.d/K76ipsec
|
||||
|
||||
1308
doc/ChangeLog
1308
doc/ChangeLog
File diff suppressed because it is too large
Load Diff
@@ -186,7 +186,7 @@
|
||||
* openldap-2.3.20
|
||||
* openssh-4.3p2
|
||||
* openssl-0.9.8d
|
||||
* openswan-2.5.13
|
||||
* openswan-2.4.8
|
||||
* openvpn-2.0.9
|
||||
* pam_mysql-0.7RC1
|
||||
* patch-2.5.4
|
||||
|
||||
@@ -69,12 +69,12 @@ ifeq "$(SMP)" "1"
|
||||
cp -f $(DIR_APP)/ipt_ipp2p.ko /lib/modules/$(KVER)-ipfire-smp/kernel/net/ipv4/netfilter
|
||||
else
|
||||
ifeq "$(IPT)" "1"
|
||||
cd $(DIR_APP) && make
|
||||
cp -f $(DIR_APP)/libipt_ipp2p.o /lib/iptables
|
||||
cd $(DIR_APP) && make libipt_ipp2p.so
|
||||
cp -f $(DIR_APP)/libipt_ipp2p.so /lib/iptables
|
||||
else
|
||||
cd $(DIR_APP) && make ipt_ipp2p.ko
|
||||
cp -f $(DIR_APP)/ipt_ipp2p.ko /lib/modules/$(KVER)-ipfire/kernel/net/ipv4/netfilter
|
||||
endif
|
||||
endif
|
||||
@rm -rf $(DIR_APP) $(DIR_SRC)/iptables-*
|
||||
@rm -rf $(DIR_APP) $(DIR_SRC)/iptables*
|
||||
@$(POSTBUILD)
|
||||
|
||||
12
lfs/linux
12
lfs/linux
@@ -59,7 +59,7 @@ objects =$(DL_FILE) \
|
||||
patch-o-matic-ng-20061210.tar.bz2 \
|
||||
netfilter-layer7-v2.9.tar.gz \
|
||||
patch-2.6.16-nath323-1.3.bz2 \
|
||||
openswan-2.5.13.tar.gz
|
||||
openswan-2.4.8.tar.gz
|
||||
|
||||
$(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE)
|
||||
patch-o-matic-ng-20061210.tar.bz2 = $(URL_IPFIRE)/patch-o-matic-ng-20061210.tar.bz2
|
||||
@@ -68,7 +68,7 @@ netfilter-layer7-v2.9.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.9.tar.gz
|
||||
patch-2.6.16-nath323-1.3.bz2 = $(URL_IPFIRE)/patch-2.6.16-nath323-1.3.bz2
|
||||
squashfs3.2-r2.tar.gz = $(URL_IPFIRE)/squashfs3.2-r2.tar.gz
|
||||
mISDN-1_1_3.tar.gz = $(URL_IPFIRE)/mISDN-1_1_3.tar.gz
|
||||
openswan-2.5.13.tar.gz = $(URL_IPFIRE)/openswan-2.5.13.tar.gz
|
||||
openswan-2.4.8.tar.gz = $(URL_IPFIRE)/openswan-2.4.8.tar.gz
|
||||
|
||||
$(DL_FILE)_MD5 = cc2106c6188675187d636aa518b04958
|
||||
linux-2.6.16.33.tar.bz2_MD5 = 22f56e3a5e7524b2bbde2696152b5ad7
|
||||
@@ -78,7 +78,7 @@ netfilter-layer7-v2.9.tar.gz_MD5 = ebf9043a5352ebe6dbd721989ef83dee
|
||||
patch-2.6.16-nath323-1.3.bz2_MD5 = f926409ff703a307baf54b57ab75d138
|
||||
squashfs3.2-r2.tar.gz_MD5 = bf360b92eba9e6d5610196ce2e02fcd1
|
||||
mISDN-1_1_3.tar.gz_MD5 = d29bcf48f16fc8a9b9f3552d111b308d
|
||||
openswan-2.5.13.tar.gz_MD5 = b83a42ea00ee24ed34413bc122cada51
|
||||
openswan-2.4.8.tar.gz_MD5 = 918cc56ccf8e5d14cd2047e47450b34a
|
||||
|
||||
install : $(TARGET)
|
||||
|
||||
@@ -121,9 +121,9 @@ endif
|
||||
|
||||
# Openswan 2
|
||||
cd $(DIR_SRC) && rm -rf openswan-*
|
||||
cd $(DIR_SRC) && tar xfz $(DIR_DL)/openswan-2.5.13.tar.gz
|
||||
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openswan-2.5.13.kernel-2.6-klips.patch
|
||||
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openswan-2.5.13.kernel-2.6-natt.patch
|
||||
cd $(DIR_SRC) && tar xfz $(DIR_DL)/openswan-2.4.8.tar.gz
|
||||
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openswan-2.4.8.kernel-2.6-klips.patch
|
||||
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openswan-2.4.8.kernel-2.6-natt.patch
|
||||
|
||||
cd $(DIR_SRC)/openswan-* && sed -i -e 's/INC_USRLOCAL=\/usr\/local/INC_USRLOCAL=\/usr/' Makefile.inc
|
||||
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
include Config
|
||||
|
||||
VER = 2.5.13
|
||||
VER = 2.4.8
|
||||
|
||||
THISAPP = openswan-$(VER)
|
||||
DL_FILE = $(THISAPP).tar.gz
|
||||
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
|
||||
|
||||
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
||||
|
||||
$(DL_FILE)_MD5 = b83a42ea00ee24ed34413bc122cada51
|
||||
$(DL_FILE)_MD5 = 918cc56ccf8e5d14cd2047e47450b34a
|
||||
|
||||
install : $(TARGET)
|
||||
|
||||
|
||||
@@ -124,12 +124,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
||||
chmod 775 /srv/web/ipfire/html/updatecache/metadata
|
||||
chmod 755 /var/log/updatexlrator
|
||||
|
||||
chwon squid:squid /var/log/squid
|
||||
mkdir /usr/lib/squid/auth
|
||||
cp -f $(DIR_SRC)/config/proxy/auth /usr/lib/squid/auth
|
||||
chown squid:squid /var/log/squid
|
||||
ln -sf /usr/lib/squid /usr/lib/squid/auth
|
||||
cp -f $(DIR_SRC)/config/proxy/proxy.pac /srv/web/ipfire/html/proxy.pac
|
||||
chown nobody.nobody /srv/web/ipfire/html/proxy.pac
|
||||
ln -f /srv/web/ipfire/html/proxy.pac /srv/web/ipfire/html//wpad.dat
|
||||
ln -sf /srv/web/ipfire/html/proxy.pac /srv/web/ipfire/html/wpad.dat
|
||||
|
||||
@rm -rf $(DIR_APP)
|
||||
@$(POSTBUILD)
|
||||
|
||||
2
make.sh
2
make.sh
@@ -337,7 +337,7 @@ buildipfire() {
|
||||
# ipfiremake promise-sata-300-tx SMP=1
|
||||
ipfiremake zaptel SMP=1
|
||||
ipfiremake fuse SMP=1
|
||||
ipfiremake linux XEN=1
|
||||
#ipfiremake linux XEN=1
|
||||
ipfiremake linux
|
||||
ipfiremake ipp2p
|
||||
ipfiremake fcdsl
|
||||
|
||||
@@ -8,7 +8,7 @@ SUID_PROGS = setdmzholes setportfw setfilters setxtaccess \
|
||||
squidctrl restartssh ipfirereboot setaliases \
|
||||
ipsecctrl timectrl dhcpctrl snortctrl \
|
||||
monitorTraff restartapplejuice rebuildhosts \
|
||||
restartsyslogd logwatch openvpnctrl \
|
||||
restartsyslogd logwatch openvpnctrl outgoingfwctrl \
|
||||
restartwireless getipstat qosctrl launch-ether-wake \
|
||||
redctrl extrahdctrl sambactrl upnpctrl tripwirectrl \
|
||||
smartctrl clamavctrl
|
||||
@@ -67,6 +67,9 @@ monitorTraff: monitorTraff.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
clamavctrl: clamavctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ clamavctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
outgoingfwctrl: outgoingfwctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ outgoingfwctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
timectrl: timectrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ timectrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
|
||||
23
src/misc-progs/outgoingfwctrl.c
Normal file
23
src/misc-progs/outgoingfwctrl.c
Normal file
@@ -0,0 +1,23 @@
|
||||
/* This file is part of the IPFire Firewall.
|
||||
*
|
||||
* This program is distributed under the terms of the GNU General Public
|
||||
* Licence. See the file COPYING for details.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <fcntl.h>
|
||||
#include "setuid.h"
|
||||
|
||||
int main(int argc, char *argv[]) {
|
||||
|
||||
if (!(initsetuid()))
|
||||
exit(1);
|
||||
|
||||
safe_system("/var/ipfire/outgoing/bin/outgoingfw.pl");
|
||||
return 0;
|
||||
}
|
||||
59382
src/patches/openswan-2.4.8.kernel-2.6-klips.patch
Normal file
59382
src/patches/openswan-2.4.8.kernel-2.6-klips.patch
Normal file
File diff suppressed because it is too large
Load Diff
125
src/patches/openswan-2.4.8.kernel-2.6-natt.patch
Normal file
125
src/patches/openswan-2.4.8.kernel-2.6-natt.patch
Normal file
@@ -0,0 +1,125 @@
|
||||
packaging/utils/nattpatch 2.6
|
||||
--- /dev/null Tue Mar 11 13:02:56 2003
|
||||
+++ nat-t/include/net/xfrmudp.h Mon Feb 9 13:51:03 2004
|
||||
@@ -0,0 +1,10 @@
|
||||
+/*
|
||||
+ * pointer to function for type that xfrm4_input wants, to permit
|
||||
+ * decoupling of XFRM from udp.c
|
||||
+ */
|
||||
+#define HAVE_XFRM4_UDP_REGISTER
|
||||
+
|
||||
+typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
|
||||
+extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
|
||||
+ , xfrm4_rcv_encap_t *oldfunc);
|
||||
+extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
|
||||
--- /distros/kernel/linux-2.6.11.2/net/ipv4/Kconfig 2005-03-09 03:12:33.000000000 -0500
|
||||
+++ swan26/net/ipv4/Kconfig 2005-04-04 18:46:13.000000000 -0400
|
||||
@@ -351,2 +351,8 @@
|
||||
|
||||
+config IPSEC_NAT_TRAVERSAL
|
||||
+ bool "IPSEC NAT-Traversal (KLIPS compatible)"
|
||||
+ depends on INET
|
||||
+ ---help---
|
||||
+ Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
|
||||
+
|
||||
config IP_TCPDIAG
|
||||
--- plain26/net/ipv4/udp.c.orig 2006-01-02 22:21:10.000000000 -0500
|
||||
+++ plain26/net/ipv4/udp.c 2006-01-12 20:18:57.000000000 -0500
|
||||
@@ -110,2 +110,3 @@
|
||||
#include <net/xfrm.h>
|
||||
+#include <net/xfrmudp.h>
|
||||
|
||||
@@ -894,6 +897,44 @@
|
||||
sk_common_release(sk);
|
||||
}
|
||||
|
||||
+#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
|
||||
+
|
||||
+/* if XFRM isn't a module, then register it directly. */
|
||||
+#if !defined(CONFIG_XFRM_MODULE)
|
||||
+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
|
||||
+#else
|
||||
+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
|
||||
+#endif
|
||||
+
|
||||
+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
|
||||
+
|
||||
+int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
|
||||
+ , xfrm4_rcv_encap_t *oldfunc)
|
||||
+{
|
||||
+ if(oldfunc != NULL) {
|
||||
+ *oldfunc = xfrm4_rcv_encap_func;
|
||||
+ }
|
||||
+
|
||||
+#if 0
|
||||
+ if(xfrm4_rcv_encap_func != NULL)
|
||||
+ return -1;
|
||||
+#endif
|
||||
+
|
||||
+ xfrm4_rcv_encap_func = func;
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
|
||||
+{
|
||||
+ if(xfrm4_rcv_encap_func != func)
|
||||
+ return -1;
|
||||
+
|
||||
+ xfrm4_rcv_encap_func = NULL;
|
||||
+ return 0;
|
||||
+}
|
||||
+#endif /* CONFIG_XFRM || defined(CONFIG_IPSEC_NAT_TRAVERSAL)*/
|
||||
+
|
||||
+
|
||||
/* return:
|
||||
* 1 if the the UDP system should process it
|
||||
* 0 if we should drop this packet
|
||||
@@ -901,9 +940,9 @@
|
||||
*/
|
||||
static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
|
||||
{
|
||||
-#ifndef CONFIG_XFRM
|
||||
+#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
|
||||
return 1;
|
||||
-#else
|
||||
+#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */
|
||||
struct udp_sock *up = udp_sk(sk);
|
||||
struct udphdr *uh = skb->h.uh;
|
||||
struct iphdr *iph;
|
||||
@@ -1021,10 +1060,14 @@
|
||||
return 0;
|
||||
}
|
||||
if (ret < 0) {
|
||||
- /* process the ESP packet */
|
||||
- ret = xfrm4_rcv_encap(skb, up->encap_type);
|
||||
- UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
|
||||
- return -ret;
|
||||
+ if(xfrm4_rcv_encap_func != NULL) {
|
||||
+ ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
|
||||
+ UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
|
||||
+ } else {
|
||||
+ UDP_INC_STATS_BH(UDP_MIB_INERRORS);
|
||||
+ ret = 1;
|
||||
+ }
|
||||
+ return ret;
|
||||
}
|
||||
/* FALLTHROUGH -- it's a UDP Packet */
|
||||
}
|
||||
@@ -1114,7 +1157,6 @@
|
||||
/*
|
||||
* All we need to do is get the socket, and then do a checksum.
|
||||
*/
|
||||
-
|
||||
int udp_rcv(struct sk_buff *skb)
|
||||
{
|
||||
struct sock *sk;
|
||||
@@ -1571,3 +1613,9 @@
|
||||
EXPORT_SYMBOL(udp_proc_register);
|
||||
EXPORT_SYMBOL(udp_proc_unregister);
|
||||
#endif
|
||||
+
|
||||
+#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
|
||||
+EXPORT_SYMBOL(udp4_register_esp_rcvencap);
|
||||
+EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
|
||||
+#endif
|
||||
+
|
||||
Reference in New Issue
Block a user