[dev][crypto][strongswan] 有关strongswan的forward policy的源码分析

一

默认情况下，我们使用strongswan建立了一个ipsec隧道之后，建立的policy如下：

[root@D129 OUTPUT]# ip xfrm policy
src 10.129.0.0/ dst 10.9.0.0/
    dir out priority  ptype main
    tmpl src 192.168.8.129 dst 192.168.8.9
        proto esp spi 0x5623adc0 reqid  mode tunnel
src 10.9.0.0/ dst 10.129.0.0/
    dir fwd priority  ptype main
    tmpl src 192.168.8.9 dst 192.168.8.129
        proto esp reqid  mode tunnel
src 10.9.0.0/ dst 10.129.0.0/
    dir in priority  ptype main
    tmpl src 192.168.8.9 dst 192.168.8.129
        proto esp reqid  mode tunnel

通过观察，我们能够总结到：

1.  一共有三条policy，分别是IN类型，OUT类型，FWD类型。

2.  IN和FWD的原目的IP对，template原目的IP对相同。OUT类型与之相反。

二

然而，我们所了解到的内容，并不仅局限于此。接下来阅读两端strongswan的代码

https://github.com/strongswan/strongswan/blob/5.7.2/src/libcharon/sa/child_sa.c

static status_t install_policies_inbound(private_child_sa_t *this,
    host_t *my_addr, host_t *other_addr, traffic_selector_t *my_ts,
... ...
    if (this->mode != MODE_TRANSPORT)
    {
        in_id.dir = POLICY_FWD;
        status |= charon->kernel->add_policy(charon->kernel, &in_id, &in_policy);
    }
    return status;
}
... ...
static status_t install_policies_outbound(private_child_sa_t *this,
    host_t *my_addr, host_t *other_addr, traffic_selector_t *my_ts,
... ...
        out_id.dir = POLICY_FWD;
        other_sa->reqid = ;
        if (priority == POLICY_PRIORITY_DEFAULT)
        {
            out_policy.prio = POLICY_PRIORITY_ROUTED;
        }
        status |= charon->kernel->add_policy(charon->kernel, &out_id,
                                             &out_policy);
        /* reset the reqid for any other further policies */
        other_sa->reqid = this->reqid;
    }
    return status;
}

通过上面的代码，可以观察到，无论是IN或OUT方向，都有其分别对应的FWD policy。并由sa的具体参数配置决定。

child_sa_t * child_sa_create(host_t *me, host_t* other,
                             child_cfg_t *config, uint32_t reqid, bool encap,
... ...
        .policies_fwd_out = config->has_option(config, OPT_FWD_OUT_POLICIES),
... ...
}

三

这个参数见swanctl.conf的手册

      connections.<conn>.children.<child>.policies_fwd_out [no]
              Whether to install outbound FWD IPsec policies or not. Enabling this is required in case there is a drop policy that would match and block forwarded traffic for this CHILD_SA.

还有一段注释，帮助理解。

        /* install an "outbound" FWD policy in case there is a drop policy
         * matching outbound forwarded traffic, to allow another tunnel to use
         * the reversed subnets and do the same we don't set a reqid (this also
         * allows the kernel backend to distinguish between the two types of
         * FWD policies). To avoid problems with symmetrically overlapping
         * policies of two SAs we install them with reduced priority.  As they
         * basically act as bypass policies for drop policies we use a higher
         * priority than is used for them. */

四

也就是说，开启“第三节”里提到的配置之后。strongswan对每一个sa产生的policy，将不是“第一节”中提到的三个，

而是四个，一个IN，一个OUT，两个FWD，两个FWD各自与IN，OUT参数一致。