denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Optionally install protocol and ports on transport mode SAs

Browse Source
This commit is contained in:
Tobias Brunner
2014-09-12 10:45:50 +02:00
parent 5dec7d2f9d
commit 90e6675a65
2 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+18 -6
View File
@@ -309,6 +309,12 @@ struct private_kernel_netlink_ipsec_t {
*/
bool install_routes;
/**
* Whether to set protocol and ports on selector installed with transport
* mode IPsec SAs
*/
bool proto_port_transport;
/**
* Whether to track the history of a policy
*/
@@ -1235,12 +1241,15 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
if (src_ts && dst_ts)
{
sa->sel = ts2selector(src_ts, dst_ts);
/* don't install proto/port on SA. This would break
* potential secondary SAs for the same address using a
* different prot/port. */
sa->sel.proto = 0;
sa->sel.dport = sa->sel.dport_mask = 0;
sa->sel.sport = sa->sel.sport_mask = 0;
if (!this->proto_port_transport)
{
/* don't install proto/port on SA. This would break
* potential secondary SAs for the same address using a
* different prot/port. */
sa->sel.proto = 0;
sa->sel.dport = sa->sel.dport_mask = 0;
sa->sel.sport = sa->sel.sport_mask = 0;
}
}
break;
default:
@@ -2683,6 +2692,9 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
.policy_history = TRUE,
.install_routes = lib->settings->get_bool(lib->settings,
"%s.install_routes", TRUE, lib->ns),
.proto_port_transport = lib->settings->get_bool(lib->settings,
"%s.plugins.kernel-netlink.set_proto_port_transport_sa",
FALSE, lib->ns),
);
if (streq(lib->ns, "starter"))