denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Add an option to enforce using XFRM_MSG_UPDPOLICY

Browse Source
This commit is contained in:
Martin Willi
2014-11-21 10:55:45 +01:00
parent 3065081c3e
commit 8925abbec4
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+12
View File
@@ -321,6 +321,11 @@ struct private_kernel_netlink_ipsec_t {
*/ */
bool policy_history; bool policy_history;
/**
* Wheter to always use UPDATE to install policies
*/
bool policy_update;
/** /**
* Installed port based IKE bypass policies, as bypass_t * Installed port based IKE bypass policies, as bypass_t
*/ */
@@ -2319,6 +2324,11 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
return SUCCESS; return SUCCESS;
} }
if (this->policy_update)
{
found = TRUE;
}
DBG2(DBG_KNL, "%s policy %R === %R %N (mark %u/0x%08x)", DBG2(DBG_KNL, "%s policy %R === %R %N (mark %u/0x%08x)",
found ? "updating" : "adding", src_ts, dst_ts, found ? "updating" : "adding", src_ts, dst_ts,
policy_dir_names, direction, mark.value, mark.mask); policy_dir_names, direction, mark.value, mark.mask);
@@ -2849,6 +2859,8 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
.bypass = array_create(sizeof(bypass_t), 0), .bypass = array_create(sizeof(bypass_t), 0),
.mutex = mutex_create(MUTEX_TYPE_DEFAULT), .mutex = mutex_create(MUTEX_TYPE_DEFAULT),
.policy_history = TRUE, .policy_history = TRUE,
.policy_update = lib->settings->get_bool(lib->settings,
"%s.plugins.kernel-netlink.policy_update", FALSE, lib->ns),
.install_routes = lib->settings->get_bool(lib->settings, .install_routes = lib->settings->get_bool(lib->settings,
"%s.install_routes", TRUE, lib->ns), "%s.install_routes", TRUE, lib->ns),
.proto_port_transport = lib->settings->get_bool(lib->settings, .proto_port_transport = lib->settings->get_bool(lib->settings,