denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shunt-manager: Install "outbound" FWD policy

Browse Source 
If there is a default drop policy forwarded traffic might otherwise not
be allowed by a specific passthrough policy (while local traffic is
allowed).
This commit is contained in:
Tobias Brunner
2016-04-09 16:51:00 +02:00
committed by Andreas Steffen
parent 83312ee5e4
commit 23f25f9647
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/shunt_manager.c
+8 -2
View File
@@ -124,6 +124,9 @@ static bool install_shunt_policy(child_cfg_t *child)
.sa = &sa, .sa = &sa,
}; };
status |= charon->kernel->add_policy(charon->kernel, &id, &policy); status |= charon->kernel->add_policy(charon->kernel, &id, &policy);
/* install "outbound" forward policy */
id.dir = POLICY_FWD;
status |= charon->kernel->add_policy(charon->kernel, &id, &policy);
/* install in policy */ /* install in policy */
id = (kernel_ipsec_policy_id_t){ id = (kernel_ipsec_policy_id_t){
.dir = POLICY_IN, .dir = POLICY_IN,
@@ -132,7 +135,7 @@ static bool install_shunt_policy(child_cfg_t *child)
.mark = child->get_mark(child, TRUE), .mark = child->get_mark(child, TRUE),
}; };
status |= charon->kernel->add_policy(charon->kernel, &id, &policy); status |= charon->kernel->add_policy(charon->kernel, &id, &policy);
/* install forward policy */ /* install "inbound" forward policy */
id.dir = POLICY_FWD; id.dir = POLICY_FWD;
status |= charon->kernel->add_policy(charon->kernel, &id, &policy); status |= charon->kernel->add_policy(charon->kernel, &id, &policy);
} }
@@ -267,6 +270,9 @@ static void uninstall_shunt_policy(child_cfg_t *child)
.sa = &sa, .sa = &sa,
}; };
status |= charon->kernel->del_policy(charon->kernel, &id, &policy); status |= charon->kernel->del_policy(charon->kernel, &id, &policy);
/* uninstall "outbound" forward policy */
id.dir = POLICY_FWD;
status |= charon->kernel->del_policy(charon->kernel, &id, &policy);
/* uninstall in policy */ /* uninstall in policy */
id = (kernel_ipsec_policy_id_t){ id = (kernel_ipsec_policy_id_t){
.dir = POLICY_IN, .dir = POLICY_IN,
@@ -275,7 +281,7 @@ static void uninstall_shunt_policy(child_cfg_t *child)
.mark = child->get_mark(child, TRUE), .mark = child->get_mark(child, TRUE),
}; };
status |= charon->kernel->del_policy(charon->kernel, &id, &policy); status |= charon->kernel->del_policy(charon->kernel, &id, &policy);
/* uninstall forward policy */ /* uninstall "inbound" forward policy */
id.dir = POLICY_FWD; id.dir = POLICY_FWD;
status |= charon->kernel->del_policy(charon->kernel, &id, &policy); status |= charon->kernel->del_policy(charon->kernel, &id, &policy);
} }