diff options
| author | tteras <tteras@NetBSD.org> | 2009-03-06 11:45:03 +0000 |
|---|---|---|
| committer | tteras <tteras@NetBSD.org> | 2009-03-06 11:45:03 +0000 |
| commit | e3372d2f8f7971a8d6b0edc84710d34838c59cd6 (patch) | |
| tree | cbf45ed94ecf3f78ffacd8c2ee6a18d4316e1bae /crypto/dist/ipsec-tools/src/setkey/parse.y | |
| parent | 61b1fbae0d39e80bffb534617bded468a7ca36be (diff) | |
setkey: fix deleteall in Linux
Linux requires SADB_DELETE message to have SPI. So send
a SADB_DELETE message for each matching SA. Trac #284.
From: Gabriel Somlo <somlo@cmu.edu>
Diffstat (limited to 'crypto/dist/ipsec-tools/src/setkey/parse.y')
| -rw-r--r-- | crypto/dist/ipsec-tools/src/setkey/parse.y | 26 |
1 files changed, 21 insertions, 5 deletions
diff --git a/crypto/dist/ipsec-tools/src/setkey/parse.y b/crypto/dist/ipsec-tools/src/setkey/parse.y index 2f7e8566e46..4b211a2b43e 100644 --- a/crypto/dist/ipsec-tools/src/setkey/parse.y +++ b/crypto/dist/ipsec-tools/src/setkey/parse.y @@ -1,4 +1,4 @@ -/* $NetBSD: parse.y,v 1.11 2008/12/29 12:54:33 mlelstv Exp $ */ +/* $NetBSD: parse.y,v 1.12 2009/03/06 11:45:03 tteras Exp $ */ /* $KAME: parse.y,v 1.81 2003/07/01 04:01:48 itojun Exp $ */ @@ -211,11 +211,27 @@ delete_command deleteall_command : DELETEALL ipaddropts ipaddr ipaddr protocol_spec EOT { - int status; - - status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1); - if (status < 0) +#ifndef __linux__ + if (setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1) < 0) return -1; +#else /* __linux__ */ + /* linux strictly adheres to RFC2367, and returns + * an error if we send an SADB_DELETE request without + * an SPI. Therefore, we must first retrieve a list + * of SPIs for all matching SADB entries, and then + * delete each one separately. */ + u_int32_t *spi; + int i, n; + + spi = sendkeymsg_spigrep($5, $3, $4, &n); + for (i = 0; i < n; i++) { + p_spi = spi[i]; + if (setkeymsg_addr(SADB_DELETE, + $5, $3, $4, 0) < 0) + return -1; + } + free(spi); +#endif /* __linux__ */ } ; |
