denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Document kernel requirements for set_mark_in/set_mark_out options

Browse Source
This commit is contained in:
Martin Willi
2018-08-31 12:26:40 +02:00
committed by Tobias Brunner
parent 60f7896923
commit b9aacf9adc
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+5
View File
@@ -921,6 +921,8 @@ connections.<conn>.children.<child>.set_mark_in = 0/0x00000000
An additional mask may be appended to the mark, separated by _/_. The An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff. default mask if omitted is 0xffffffff.
Setting marks in XFRM input requires Linux 4.19 or higher.
connections.<conn>.children.<child>.set_mark_out = 0/0x00000000 connections.<conn>.children.<child>.set_mark_out = 0/0x00000000
Netfilter mark applied to packets after the outbound IPsec SA processed Netfilter mark applied to packets after the outbound IPsec SA processed
them. them.
@@ -932,6 +934,9 @@ connections.<conn>.children.<child>.set_mark_out = 0/0x00000000
An additional mask may be appended to the mark, separated by _/_. The An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff. default mask if omitted is 0xffffffff.
Setting marks in XFRM output is supported since Linux 4.14. Setting a mask
requires at least Linux 4.19.
connections.<conn>.children.<child>.tfc_padding = 0 connections.<conn>.children.<child>.tfc_padding = 0
Traffic Flow Confidentiality padding. Traffic Flow Confidentiality padding.