denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Optionally install protocol and ports on transport mode SAs

Browse Source
This commit is contained in:
Tobias Brunner
2014-09-12 10:45:50 +02:00
parent 5dec7d2f9d
commit 90e6675a65
2 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/kernel-netlink.opt
+9
View File
@@ -16,6 +16,15 @@ charon.plugins.kernel-netlink.mtu = 0
charon.plugins.kernel-netlink.roam_events = yes charon.plugins.kernel-netlink.roam_events = yes
Whether to trigger roam events when interfaces, addresses or routes change. Whether to trigger roam events when interfaces, addresses or routes change.
charon.plugins.kernel-netlink.set_proto_port_transport_sa = no
Whether to set protocol and ports in the selector installed on transport
mode IPsec SAs in the kernel.
Whether to set protocol and ports in the selector installed on transport
mode IPsec SAs in the kernel. While doing so enforces policies for inbound
traffic, it also prevents the use of a single IPsec SA by more than one
traffic selector.
charon.plugins.kernel-netlink.xfrm_acq_expires = 165 charon.plugins.kernel-netlink.xfrm_acq_expires = 165
Lifetime of XFRM acquire state in kernel. Lifetime of XFRM acquire state in kernel.
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+18 -6
View File
@@ -309,6 +309,12 @@ struct private_kernel_netlink_ipsec_t {
*/ */
bool install_routes; bool install_routes;
/**
* Whether to set protocol and ports on selector installed with transport
* mode IPsec SAs
*/
bool proto_port_transport;
/** /**
* Whether to track the history of a policy * Whether to track the history of a policy
*/ */
@@ -1235,12 +1241,15 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
if (src_ts && dst_ts) if (src_ts && dst_ts)
{ {
sa->sel = ts2selector(src_ts, dst_ts); sa->sel = ts2selector(src_ts, dst_ts);
/* don't install proto/port on SA. This would break if (!this->proto_port_transport)
* potential secondary SAs for the same address using a {
* different prot/port. */ /* don't install proto/port on SA. This would break
sa->sel.proto = 0; * potential secondary SAs for the same address using a
sa->sel.dport = sa->sel.dport_mask = 0; * different prot/port. */
sa->sel.sport = sa->sel.sport_mask = 0; sa->sel.proto = 0;
sa->sel.dport = sa->sel.dport_mask = 0;
sa->sel.sport = sa->sel.sport_mask = 0;
}
} }
break; break;
default: default:
@@ -2683,6 +2692,9 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
.policy_history = TRUE, .policy_history = TRUE,
.install_routes = lib->settings->get_bool(lib->settings, .install_routes = lib->settings->get_bool(lib->settings,
"%s.install_routes", TRUE, lib->ns), "%s.install_routes", TRUE, lib->ns),
.proto_port_transport = lib->settings->get_bool(lib->settings,
"%s.plugins.kernel-netlink.set_proto_port_transport_sa",
FALSE, lib->ns),
); );
if (streq(lib->ns, "starter")) if (streq(lib->ns, "starter"))