denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Alternatively support global port based IKE bypass policies

Browse Source 
The socket based IKE bypass policies are usually superior, but not supported
on all networking stacks. The port based variant uses global policies for the
UDP ports we have IKE sockets for.
This commit is contained in:
Martin Willi
2014-11-21 10:55:45 +01:00
parent 6f9df556ba
commit 87888f9926
2 changed files with 169 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/kernel-netlink.opt
+9
View File
@@ -24,6 +24,15 @@ charon.plugins.kernel-netlink.parallel_route = no
charon.plugins.kernel-netlink.parallel_xfrm = no
Whether to perform concurrent Netlink XFRM queries on a single socket.
charon.plugins.kernel-netlink.port_bypass = no
Whether to use port or socket based IKE XFRM bypass policies.
Whether to use port or socket based IKE XFRM bypass policies.
IKE bypass policies are used to exempt IKE traffic from XFRM processing.
The default socket based policies are directly tied to the IKE UDP sockets,
port based policies use global XFRM bypass policies for the used IKE UDP
ports.
charon.plugins.kernel-netlink.roam_events = yes
Whether to trigger roam events when interfaces, addresses or routes change.