denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Use interface to next hop for shunt policies

Browse Source 
Using the source address to determine the interface is not correct for
net-to-net shunts between two interfaces on which the host has IP addresses
for each subnet.
This commit is contained in:
Tobias Brunner
2016-06-10 13:57:27 +02:00
parent 66e9165bc6
commit 4ba5ea407b
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+13 -10
View File
@@ -2335,19 +2335,22 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
/* get the interface to install the route for. If we have a local /* get the interface to install the route for. If we have a local
* address, use it. Otherwise (for shunt policies) use the * address, use it. Otherwise (for shunt policies) use the
* routes source address. */ * route's source address. */
iface = ipsec->dst; iface = ipsec->dst;
if (iface->is_anyaddr(iface)) if (iface->is_anyaddr(iface))
{ {
iface = route->src_ip; iface = ipsec->dst;
} if (iface->is_anyaddr(iface))
/* install route via outgoing interface */ {
if (!charon->kernel->get_interface(charon->kernel, iface, iface = route->src_ip;
&route->if_name)) }
{ if (!charon->kernel->get_interface(charon->kernel, iface,
policy_change_done(this, policy); &route->if_name))
route_entry_destroy(route); {
return SUCCESS; policy_change_done(this, policy);
route_entry_destroy(route);
return SUCCESS;
}
} }
if (policy->route) if (policy->route)