denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: install selectors on SA for transport/BEET mode without proto/port

Browse Source 
If a transport/BEET SA has different selectors for different proto/ports,
installing just the proto/port of the first SA would break any additional
selector.
This commit is contained in:
Martin Willi
2013-06-19 16:36:01 +02:00
parent 4a7c29bf02
commit 3d1af879d2
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+6
View File
@@ -1224,6 +1224,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
if(src_ts && dst_ts) if(src_ts && dst_ts)
{ {
sa->sel = ts2selector(src_ts, dst_ts); sa->sel = ts2selector(src_ts, dst_ts);
/* don't install proto/port on SA. This would break
* potential secondary SAs for the same address using a
* different prot/port. */
sa->sel.proto = 0;
sa->sel.dport = sa->sel.dport_mask = 0;
sa->sel.sport = sa->sel.sport_mask = 0;
} }
break; break;
default: default: