From 64646a1ea297483cda5159924153823633388c9f Mon Sep 17 00:00:00 2001 From: Masahide NAKAMURA Date: Sun, 11 Feb 2007 07:52:53 +0900 Subject: [KERNELIF] IPSEC: Detect MIGRATE by kernel. To use IPsec tunnel between MN and HA you need MIGRATE supported kernel whose version is 2.6.21 or later. This patch add a detection and disable to use it if it is missing MIGRATE when building. --- src/gram.y | 11 +++++++++++ src/ipsec.c | 11 +++++++++++ 2 files changed, 22 insertions(+), 0 deletions(-) diff --git a/src/gram.y b/src/gram.y index a674d53..ccda368 100644 --- a/src/gram.y +++ b/src/gram.y @@ -512,6 +512,17 @@ ipsecpolicydef : ipsectype ipsecprotos ipsecreqid xfrmaction ';' e->ha_addr = ipsec_ps.ha; e->mn_addr = hai->hoa.addr; e->type = $1; +#ifndef XFRM_MSG_MIGRATE + switch (e->type) { + case IPSEC_POLICY_TYPE_TUNNELHOMETESTING: + case IPSEC_POLICY_TYPE_TUNNELMH: + case IPSEC_POLICY_TYPE_TUNNELPAYLOAD: + uerror("cannot use IPsec tunnel because it is not built with MIGRATE"); + return -1; + default: + break; + } +#endif #ifndef MULTIPROTO_MIGRATE if ($2 != IPSEC_PROTO_ESP) { uerror("only UseESP is allowed"); diff --git a/src/ipsec.c b/src/ipsec.c index 7cb9190..449622c 100644 --- a/src/ipsec.c +++ b/src/ipsec.c @@ -77,6 +77,7 @@ static void _set_tmpl(struct xfrm_user_tmpl *tmpl, memcpy(&tmpl->saddr, tsrc, sizeof(struct in6_addr)); } +#ifdef XFRM_MSG_MIGRATE /* * xfrm_sendmigrate -- send MIGRATE message to the kernel * @@ -150,6 +151,16 @@ static int xfrm_sendmigrate(struct xfrm_userpolicy_info *sp, return ((err == 0 || err == -ENOENT) ? 0 : -1); } +#else +static int xfrm_sendmigrate(struct xfrm_userpolicy_info *sp, + const struct xfrm_user_tmpl *tmpl, + const struct in6_addr *ndst, + const struct in6_addr *nsrc) +{ + dbg("Error because it is built without XFRM_MSG_MIGRATE\n"); + return -1; +} +#endif int ipsec_policy_apply(const struct in6_addr *haaddr, const struct in6_addr *hoa, -- 1.5.0.3