denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Use interface to next hop for shunt policies

Browse Source 
Using the source address to determine the interface is not correct for
net-to-net shunts between two interfaces on which the host has IP addresses
for each subnet.
This commit is contained in:
Tobias Brunner
2016-06-10 13:57:27 +02:00
parent 66e9165bc6
commit 4ba5ea407b
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+5 -2
View File
@@ -2335,13 +2335,15 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
/* get the interface to install the route for. If we have a local /* get the interface to install the route for. If we have a local
* address, use it. Otherwise (for shunt policies) use the * address, use it. Otherwise (for shunt policies) use the
* routes source address. */ * route's source address. */
iface = ipsec->dst;
if (iface->is_anyaddr(iface))
{
iface = ipsec->dst; iface = ipsec->dst;
if (iface->is_anyaddr(iface)) if (iface->is_anyaddr(iface))
{ {
iface = route->src_ip; iface = route->src_ip;
} }
/* install route via outgoing interface */
if (!charon->kernel->get_interface(charon->kernel, iface, if (!charon->kernel->get_interface(charon->kernel, iface,
&route->if_name)) &route->if_name))
{ {
@@ -2349,6 +2351,7 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
route_entry_destroy(route); route_entry_destroy(route);
return SUCCESS; return SUCCESS;
} }
}
if (policy->route) if (policy->route)
{ {