denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Implement passthrough type routes and use them on Linux

Browse Source 
Enables us to ignore any future kernel features for routes unless
we actually need to consider them for the source IP routes.

Also enables us to actually really skip IPsec processing for those networks
(because even the routes don't touch those packets). It's more what
users expect.

Co-authored-by: Tobias Brunner <[email protected]>
This commit is contained in:
Noel KuntzeandTobias Brunner authored and Tobias Brunner committed 2020-03-10 10:20:58 +01:00
1 parent 4958acc0c2
commit 09f4bccfea
11 files changed
+124 -80
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
+8 -8
View File
@@ -315,7 +315,7 @@ static void add_exclude_route(private_kernel_libipsec_ipsec_t *this,
if (charon->kernel->get_interface(charon->kernel, src, &if_name) &&
charon->kernel->add_route(charon->kernel, dst->get_address(dst),
dst->get_family(dst) == AF_INET ? 32 : 128,
gtw, src, if_name) == SUCCESS)
gtw, src, if_name, TRUE) == SUCCESS)
{
INIT(exclude,
.dst = dst->clone(dst),
@@ -363,7 +363,7 @@ static void remove_exclude_route(private_kernel_libipsec_ipsec_t *this,
charon->kernel->del_route(charon->kernel, dst->get_address(dst),
dst->get_family(dst) == AF_INET ? 32 : 128,
route->exclude->gtw, route->exclude->src,
if_name) != SUCCESS)
if_name, TRUE) != SUCCESS)
{
DBG1(DBG_KNL, "uninstalling exclude route for %H failed", dst);
}
@@ -449,8 +449,8 @@ static bool install_route(private_kernel_libipsec_ipsec_t *this,
}
/* uninstall previously installed route */
if (charon->kernel->del_route(charon->kernel, old->dst_net,
old->prefixlen, old->gateway,
old->src_ip, old->if_name) != SUCCESS)
old->prefixlen, old->gateway, old->src_ip,
old->if_name, FALSE) != SUCCESS)
{
DBG1(DBG_KNL, "error uninstalling route installed with policy "
"%R === %R %N", src_ts, dst_ts, policy_dir_names,
@@ -481,7 +481,7 @@ static bool install_route(private_kernel_libipsec_ipsec_t *this,
switch (charon->kernel->add_route(charon->kernel, route->dst_net,
route->prefixlen, route->gateway,
route->src_ip, route->if_name))
route->src_ip, route->if_name, FALSE))
{
case ALREADY_DONE:
/* route exists, do not uninstall */
@@ -586,8 +586,8 @@ METHOD(kernel_ipsec_t, del_policy, status_t,
route_entry_t *route = policy->route;
if (charon->kernel->del_route(charon->kernel, route->dst_net,
route->prefixlen, route->gateway,
route->src_ip, route->if_name) != SUCCESS)
route->prefixlen, route->gateway, route->src_ip,
route->if_name, FALSE) != SUCCESS)
{
DBG1(DBG_KNL, "error uninstalling route installed with "
"policy %R === %R %N", id->src_ts, id->dst_ts,
@@ -618,7 +618,7 @@ METHOD(kernel_ipsec_t, flush_policies, status_t,
charon->kernel->del_route(charon->kernel, route->dst_net,
route->prefixlen, route->gateway,
route->src_ip, route->if_name);
route->src_ip, route->if_name, FALSE);
remove_exclude_route(this, route);
}
policy_entry_destroy(pol);