denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-sa: Allow requesting different unique marks for in/out

Browse Source 
When requiring unique flags for CHILD_SAs, allow the configuration to
request different marks for each direction by using the %unique-dir keyword.

This is useful when different marks are desired for each direction but the
number of peers is not predefined.

An example use case is when implementing a site-to-site route-based VPN
without VTI devices.

A use of 0.0.0.0/0 - 0.0.0.0/0 traffic selectors with identical in/out marks
results in outbound traffic being wrongfully matched against the 'fwd'
policy - for which the underlay 'template' does not match - and dropped.

Using different marks for each direction avoids this issue as the 'fwd' policy
uses the 'in' mark will not match outbound traffic.

Closes strongswan/strongswan#78.
This commit is contained in:
Eyal Birger
2017-08-07 14:22:27 +02:00
committed by Tobias Brunner
parent 00498d78a8
commit 32e5c49234
5 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/ipsec/ipsec_types.c
+14 -1
View File
@@ -66,8 +66,21 @@ bool mark_from_string(const char *value, mark_t *mark)
}
if (strcasepfx(value, "%unique"))
{
mark->value = MARK_UNIQUE;
endptr = (char*)value + strlen("%unique");
if (strcasepfx(endptr, "-dir"))
{
mark->value = MARK_UNIQUE_DIR;
endptr += strlen("-dir");
}
else if (!*endptr || *endptr == '/')
{
mark->value = MARK_UNIQUE;
}
else
{
DBG1(DBG_APP, "invalid mark value: %s", value);
return FALSE;
}
}
else
{
src/libstrongswan/ipsec/ipsec_types.h
+3 -1
View File
@@ -178,9 +178,11 @@ struct mark_t {
};
/**
* Special mark value that uses a unique mark for each CHILD_SA
* Special mark value that uses a unique mark for each CHILD_SA (and direction)
*/
#define MARK_UNIQUE (0xFFFFFFFF)
#define MARK_UNIQUE_DIR (0xFFFFFFFE)
#define MARK_IS_UNIQUE(m) ((m) == MARK_UNIQUE || (m) == MARK_UNIQUE_DIR)
/**
* Try to parse a mark_t from the given string of the form mark[/mask].