denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-sa: Allow requesting different unique marks for in/out

Browse Source 
When requiring unique flags for CHILD_SAs, allow the configuration to
request different marks for each direction by using the %unique-dir keyword.

This is useful when different marks are desired for each direction but the
number of peers is not predefined.

An example use case is when implementing a site-to-site route-based VPN
without VTI devices.

A use of 0.0.0.0/0 - 0.0.0.0/0 traffic selectors with identical in/out marks
results in outbound traffic being wrongfully matched against the 'fwd'
policy - for which the underlay 'template' does not match - and dropped.

Using different marks for each direction avoids this issue as the 'fwd' policy
uses the 'in' mark will not match outbound traffic.

Closes strongswan/strongswan#78.
This commit is contained in:
Eyal Birger
2017-08-07 14:22:27 +02:00
committed by Tobias Brunner
parent 00498d78a8
commit 32e5c49234
5 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+4 -1
View File
@@ -1037,7 +1037,10 @@ mask of
.B 0xffffffff
is assumed. The special value
.B %unique
assigns a unique value to each newly created IPsec SA.
assigns a unique value to each newly created IPsec SA. To additionally
make the mark unique for each IPsec SA direction (in/out) the special value
.B %unique-dir
may be used.
.TP
.BR mark_in " = <value>[/<mask>]"
sets an XFRM mark in the inbound IPsec SA and