denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Don't install routes for drop policies and if protocol/ports are in the selector

Browse Source
This commit is contained in:
Tobias Brunner
2016-06-10 15:25:05 +02:00
parent e7369a9dc5
commit 85fed13c18
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+10 -3
View File
@@ -2560,13 +2560,20 @@ static status_t add_policy_internal(private_kernel_pfkey_ipsec_t *this,
/* install a route, if: /* install a route, if:
* - this is an inbound policy (to just get one for each child) * - this is an inbound policy (to just get one for each child)
* - we are in tunnel mode or install a bypass policy
* - routing is not disabled via strongswan.conf * - routing is not disabled via strongswan.conf
* - the selector is not for a specific protocol/port
* - we are in tunnel mode or install a bypass policy
*/ */
if (policy->direction == POLICY_IN && this->install_routes && if (policy->direction == POLICY_IN && this->install_routes &&
(mapping->type != POLICY_IPSEC || ipsec->cfg.mode != MODE_TRANSPORT)) policy->src.proto == IPSEC_PROTO_ANY &&
!policy->src.net->get_port(policy->src.net) &&
!policy->dst.net->get_port(policy->dst.net))
{ {
install_route(this, policy, (policy_sa_in_t*)mapping); if (mapping->type == POLICY_PASS ||
(mapping->type == POLICY_IPSEC && ipsec->cfg.mode != MODE_TRANSPORT))
{
install_route(this, policy, (policy_sa_in_t*)mapping);
}
} }
this->mutex->unlock(this->mutex); this->mutex->unlock(this->mutex);
return SUCCESS; return SUCCESS;