spd tunnel mode

[Naveen BN <naveen.bn@xxxxxxxxxxxxxxxxxx>]

Hi all,
> Please find the below example code for framing tunnel mode secured 
> policy for a range of ipaddress.
> I am not able to create a security policy .
Please help me to resolve this issue
> INT32   ipsec_spd_add(INT32 dir, INT32 proto, INT32 level, INT8 * addr1,
>             UINT16 sPort, INT8 * addr2, UINT16 dPort, INT8 * 
> proxy_addr) {
>         INT8   *buf = NULL;
>         INT32   off = 0;
>         INT32   len = 0;
>         INT32   so = 0;
>         SEC_SOCKADDR_T sa1;
>         SEC_SOCKADDR_T sa2;
>         SEC_SOCKADDR_T proxy;
>         struct sadb_address *proxy_ext;
>         struct sadb_x_policy *policy;
>         struct sadb_x_ipsecrequest *req;
>
>         /*Address1 */
>         xmemset(&sa1, 0, sizeof(SEC_SOCKADDR_T));
>         sa1.sin_family = OSA_PF_INET;
>         sa1.sin_port = htons(sPort);
>         /* it returns zero, if input is invalid */
>         if (SEC_INET_ATON(addr1, &(sa1.sin_addr)) == 0) {
>             printf("invalid address\n");
>             return IPSEC_ERROR;
>         }
>
>         /*Address2 */
>         xmemset(&sa2, 0, sizeof(SEC_SOCKADDR_T));
>         sa2.sin_family = OSA_PF_INET;
>         sa2.sin_port = htons(dPort);
>         /* it returns zero, if input is invalid */
>         if (SEC_INET_ATON(addr2, &(sa2.sin_addr)) == 0) {
>             printf("invalid address\n");
>             return IPSEC_ERROR;
>         }
>
>         /*Proxy */
>         if (proxy_addr) {
>                         xmemset(&proxy, 0, sizeof(SEC_SOCKADDR_T));
>             proxy.sin_family = OSA_PF_INET;
>             proxy.sin_port = 0;
>             /* it returns zero, if input is invalid */
>             if (SEC_INET_ATON(proxy_addr, &(proxy.sin_addr)) == 0) {
>                 printf("invalid address\n");
>                 return IPSEC_ERROR;
>             }
>         }
>         //buf = (INT8 *)xcalloc(1,1024);
>         buf = xcalloc(1, 1024);
>         if (buf == NULL) {
>             printf("cant allocate enough memory\n");
>             return IPSEC_ERROR;
>         }
>         xmemset(buf, 0, 1024);
>         if ((so = pfkey_open()) < 0) {
>             printf("pfkey_open() error\n");
>             SEC_FREE(buf);
>             return IPSEC_ERROR;
>         }
>
>         len = PFKEY_ALIGN8(sizeof(struct sadb_x_policy));
>
>         //policy = (struct sadb_x_policy *)&pbuf->buf[pbuf->off];
>         policy = (struct sadb_x_policy *)&buf[off];
>         xmemset(policy, 0, sizeof(*policy));
>         policy->sadb_x_policy_len = PFKEY_UNIT64(len);
>         /* update later */
>         policy->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
>         policy->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
>         policy->sadb_x_policy_dir = dir;    //IPSEC_DIR_OUTBOUND;
>
>         off += len;
>
>         len = PFKEY_ALIGN8(sizeof(struct sadb_x_ipsecrequest));
>
>         req = (struct sadb_x_ipsecrequest *)&buf[off];
>         xmemset(req, 0, sizeof(struct sadb_x_ipsecrequest));
>         req->sadb_x_ipsecrequest_len = len; /* updated later */
>         req->sadb_x_ipsecrequest_proto = proto;
>         req->sadb_x_ipsecrequest_mode =(proxy_addr == NULL ? 
> IPSEC_MODE_TRANSPORT
>              : IPSEC_MODE_TUNNEL);
>                req->sadb_x_ipsecrequest_level = level;
>
>         off += len;
>
>         if (proxy_addr) {
>             len=PFKEY_ALIGN8(sizeof(struct sadb_address));
>              proxy_ext=(struct sadb_address*)&buf[off];
>             xmemset(proxy_ext,0,sizeof(struct sadb_address));
>             proxy_ext->sadb_address_len=PFKEY_UNIT64(len);
>             proxy_ext->sadb_address_exttype=SADB_EXT_ADDRESS_PROXY;
>             off +=len;
>             printf("\n ############ Filling proxy_addr message 
> ##########");             //len = PFKEY_ALIGN8(proxy->sa_len);
>             len = PFKEY_ALIGN8(sizeof(SA));
>             xmemset(&buf[off], 0, len);
>             //xmemcpy(&pbuf->buf[pbuf->off], proxy, proxy->sa_len);
>             xmemcpy(&buf[off], &proxy, sizeof(SA));
>             req->sadb_x_ipsecrequest_len += len;
>             off += len;
>         }
>
>         policy->sadb_x_policy_len = PFKEY_UNIT64(off);
>
>         if ((pfkey_send_spdadd(so, (SA *) & sa1, 32, (SA *) & sa2, 32, 
> 255,
>                         (caddr_t) buf, off, 0)) < 0) {
>             printf("pfkey_send_spdadd() error\n");
>             SEC_FREE(buf);
>             return IPSEC_ERROR;
>         }
>         free(buf);
>         return IPSEC_SUCCESS;
> }

Thanks and Regards
Naveen

_______________________________________________

Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf