diff options
| author |   reyk <reyk@openbsd.org> | 2010-07-09 16:58:06 +0000 |
|---|---|---|
| committer | reyk <reyk@openbsd.org> | 2010-07-09 16:58:06 +0000 |
| commit | 05d65ec4bc6b2a183ce998415c6c4d3200280c4d (patch) | |
| tree | cd947dd68c165f3a4182b79e1670a2b74a482bfb /sys/netinet/ipsec_output.c | |
| parent | Add the rtableid to struct rttimer and therefor make it available to (diff) | |
| download | wireguard-openbsd-05d65ec4bc6b2a183ce998415c6c4d3200280c4d.tar.xz wireguard-openbsd-05d65ec4bc6b2a183ce998415c6c4d3200280c4d.zip | |
Add support for using IPsec in multiple rdomains.
This allows to run isakmpd/iked/ipsecctl in multiple rdomains
independently (with "route exec"); the kernel will pickup the rdomain
from the process context of the pfkey socket and load the flows and
SAs into the matching rdomain encap routing table. The network stack
also needs to pass the rdomain to the ipsec stack to lookup the
correct rdomain that belongs to an interface/mbuf/... You can now run
individual IPsec configs per rdomain or create IPsec VPNs between
multiple rdomains on the same machine ;). Note that a primary enc(4)
in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1.
Test by some people, mostly on existing "rdomain 0" setups. Was in
snaps for some days and people didn't complain.
ok claudio@ naddy@
Diffstat (limited to 'sys/netinet/ipsec_output.c')
| -rw-r--r-- | sys/netinet/ipsec_output.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/netinet/ipsec_output.c b/sys/netinet/ipsec_output.c index 232f3e4d438..13601532e09 100644 --- a/sys/netinet/ipsec_output.c +++ b/sys/netinet/ipsec_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsec_output.c,v 1.42 2010/01/10 12:43:07 markus Exp $ */ +/* $OpenBSD: ipsec_output.c,v 1.43 2010/07/09 16:58:06 reyk Exp $ */ /* * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) * @@ -490,6 +490,7 @@ ipsp_process_done(struct mbuf *m, struct tdb *tdb) bcopy(&tdb->tdb_dst, &tdbi->dst, sizeof(union sockaddr_union)); tdbi->proto = tdb->tdb_sproto; tdbi->spi = tdb->tdb_spi; + tdbi->rdomain = tdb->tdb_rdomain; m_tag_prepend(m, mtag); @@ -605,7 +606,8 @@ ipsec_adjust_mtu(struct mbuf *m, u_int32_t mtu) for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL); mtag; mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, mtag)) { tdbi = (struct tdb_ident *)(mtag + 1); - tdbp = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto); + tdbp = gettdb(tdbi->rdomain, tdbi->spi, &tdbi->dst, + tdbi->proto); if (tdbp == NULL) break; |