denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-sa: Allow requesting different unique marks for in/out

Browse Source 
When requiring unique flags for CHILD_SAs, allow the configuration to
request different marks for each direction by using the %unique-dir keyword.

This is useful when different marks are desired for each direction but the
number of peers is not predefined.

An example use case is when implementing a site-to-site route-based VPN
without VTI devices.

A use of 0.0.0.0/0 - 0.0.0.0/0 traffic selectors with identical in/out marks
results in outbound traffic being wrongfully matched against the 'fwd'
policy - for which the underlay 'template' does not match - and dropped.

Using different marks for each direction avoids this issue as the 'fwd' policy
uses the 'in' mark will not match outbound traffic.

Closes strongswan/strongswan#78.
This commit is contained in:
Eyal Birger
2017-08-07 14:22:27 +02:00
committed by Tobias Brunner
parent 00498d78a8
commit 32e5c49234
5 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+6 -2
View File
@@ -870,7 +870,9 @@ connections.<conn>.children.<child>.mark_in = 0/0x00000000
Netfilter mark and mask for input traffic. On Linux Netfilter may require
marks on each packet to match an SA having that option set. This allows
Netfilter rules to select specific tunnels for incoming traffic. The
special value _%unique_ sets a unique mark on each CHILD_SA instance.
special value _%unique_ sets a unique mark on each CHILD_SA instance,
beyond that the value _%unique-dir_ assigns a different unique mark for each
CHILD_SA direction (in/out).
An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff.
@@ -881,7 +883,9 @@ connections.<conn>.children.<child>.mark_out = 0/0x00000000
Netfilter mark and mask for output traffic. On Linux Netfilter may require
marks on each packet to match a policy having that option set. This allows
Netfilter rules to select specific tunnels for outgoing traffic. The
special value _%unique_ sets a unique mark on each CHILD_SA instance.
special value _%unique_ sets a unique mark on each CHILD_SA instance,
beyond that the value _%unique-dir_ assigns a different unique mark for each
CHILD_SA direction (in/out).
An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff.