denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Don't install routes for CHILD_SAs with interface ID

Browse Source
This commit is contained in:
Tobias Brunner
2019-04-04 09:31:38 +02:00
parent 5b2078ad09
commit 801a5d3133
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+3 -1
View File
@@ -2846,10 +2846,12 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
* - this is an outbound policy (to just get one for each child) * - this is an outbound policy (to just get one for each child)
* - routing is not disabled via strongswan.conf * - routing is not disabled via strongswan.conf
* - the selector is not for a specific protocol/port * - the selector is not for a specific protocol/port
* - no XFRM interface ID is configured
* - we are in tunnel/BEET mode or install a bypass policy * - we are in tunnel/BEET mode or install a bypass policy
*/ */
if (policy->direction == POLICY_OUT && this->install_routes && if (policy->direction == POLICY_OUT && this->install_routes &&
!policy->sel.proto && !policy->sel.dport && !policy->sel.sport) !policy->sel.proto && !policy->sel.dport && !policy->sel.sport &&
!policy->if_id)
{ {
if (mapping->type == POLICY_PASS || if (mapping->type == POLICY_PASS ||
(mapping->type == POLICY_IPSEC && ipsec->cfg.mode != MODE_TRANSPORT)) (mapping->type == POLICY_IPSEC && ipsec->cfg.mode != MODE_TRANSPORT))
src/swanctl/swanctl.opt
+2
View File
@@ -934,6 +934,8 @@ connections.<conn>.children.<child>.if_id_out = 0
instance, beyond that the value _%unique-dir_ assigns a different unique instance, beyond that the value _%unique-dir_ assigns a different unique
interface ID for each CHILD_SA direction (in/out). interface ID for each CHILD_SA direction (in/out).
The daemon will not install routes for CHILD_SAs that have this option set.
connections.<conn>.children.<child>.set_mark_in = 0/0x00000000 connections.<conn>.children.<child>.set_mark_in = 0/0x00000000
Netfilter mark applied to packets after the inbound IPsec SA processed them. Netfilter mark applied to packets after the inbound IPsec SA processed them.