denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Use subnet and prefix when determining nexthop for shunt policy routes

Browse Source 
This is basically the same as 88f125f560.
This commit is contained in:
Tobias Brunner
2014-06-26 18:13:09 +02:00
parent b451303a6c
commit 60f5fb2318
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+12 -2
View File
@@ -2223,11 +2223,21 @@ static bool install_route(private_kernel_pfkey_ipsec_t *this,
INIT(route, INIT(route,
.prefixlen = policy->src.mask, .prefixlen = policy->src.mask,
.src_ip = host, .src_ip = host,
.gateway = hydra->kernel_interface->get_nexthop(
hydra->kernel_interface, dst, -1, src),
.dst_net = chunk_clone(policy->src.net->get_address(policy->src.net)), .dst_net = chunk_clone(policy->src.net->get_address(policy->src.net)),
); );
if (!dst->is_anyaddr(dst))
{
route->gateway = hydra->kernel_interface->get_nexthop(
hydra->kernel_interface, dst, -1, src);
}
else
{ /* for shunt policies */
route->gateway = hydra->kernel_interface->get_nexthop(
hydra->kernel_interface, policy->src.net,
policy->src.mask, route->src_ip);
}
/* if the IP is virtual, we install the route over the interface it has /* if the IP is virtual, we install the route over the interface it has
* been installed on. Otherwise we use the interface we use for IKE, as * been installed on. Otherwise we use the interface we use for IKE, as
* this is required for example on Linux. */ * this is required for example on Linux. */