summaryrefslogtreecommitdiff
path: root/crypto/dist/ipsec-tools/src/setkey/parse.y
diff options
context:
space:
mode:
authortteras <tteras@NetBSD.org>2009-03-06 11:45:03 +0000
committertteras <tteras@NetBSD.org>2009-03-06 11:45:03 +0000
commite3372d2f8f7971a8d6b0edc84710d34838c59cd6 (patch)
treecbf45ed94ecf3f78ffacd8c2ee6a18d4316e1bae /crypto/dist/ipsec-tools/src/setkey/parse.y
parent61b1fbae0d39e80bffb534617bded468a7ca36be (diff)
setkey: fix deleteall in Linux
Linux requires SADB_DELETE message to have SPI. So send a SADB_DELETE message for each matching SA. Trac #284. From: Gabriel Somlo <somlo@cmu.edu>
Diffstat (limited to 'crypto/dist/ipsec-tools/src/setkey/parse.y')
-rw-r--r--crypto/dist/ipsec-tools/src/setkey/parse.y26
1 files changed, 21 insertions, 5 deletions
diff --git a/crypto/dist/ipsec-tools/src/setkey/parse.y b/crypto/dist/ipsec-tools/src/setkey/parse.y
index 2f7e8566e46..4b211a2b43e 100644
--- a/crypto/dist/ipsec-tools/src/setkey/parse.y
+++ b/crypto/dist/ipsec-tools/src/setkey/parse.y
@@ -1,4 +1,4 @@
-/* $NetBSD: parse.y,v 1.11 2008/12/29 12:54:33 mlelstv Exp $ */
+/* $NetBSD: parse.y,v 1.12 2009/03/06 11:45:03 tteras Exp $ */
/* $KAME: parse.y,v 1.81 2003/07/01 04:01:48 itojun Exp $ */
@@ -211,11 +211,27 @@ delete_command
deleteall_command
: DELETEALL ipaddropts ipaddr ipaddr protocol_spec EOT
{
- int status;
-
- status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1);
- if (status < 0)
+#ifndef __linux__
+ if (setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1) < 0)
return -1;
+#else /* __linux__ */
+ /* linux strictly adheres to RFC2367, and returns
+ * an error if we send an SADB_DELETE request without
+ * an SPI. Therefore, we must first retrieve a list
+ * of SPIs for all matching SADB entries, and then
+ * delete each one separately. */
+ u_int32_t *spi;
+ int i, n;
+
+ spi = sendkeymsg_spigrep($5, $3, $4, &n);
+ for (i = 0; i < n; i++) {
+ p_spi = spi[i];
+ if (setkeymsg_addr(SADB_DELETE,
+ $5, $3, $4, 0) < 0)
+ return -1;
+ }
+ free(spi);
+#endif /* __linux__ */
}
;