denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: when installing a route for a virtual IP, use its interface

Browse Source 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
This commit is contained in:
Martin Willi
2013-05-06 16:10:13 +02:00
parent f52cf07532
commit ca4a14ae83
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+10 -1
View File
@@ -1923,9 +1923,10 @@ static bool install_route(private_kernel_pfkey_ipsec_t *this,
{ {
route_entry_t *route, *old; route_entry_t *route, *old;
host_t *host, *src, *dst; host_t *host, *src, *dst;
bool is_virtual;
if (hydra->kernel_interface->get_address_by_ts(hydra->kernel_interface, if (hydra->kernel_interface->get_address_by_ts(hydra->kernel_interface,
in->dst_ts, &host, NULL) != SUCCESS) in->dst_ts, &host, &is_virtual) != SUCCESS)
{ {
return FALSE; return FALSE;
} }
@@ -1942,6 +1943,14 @@ static bool install_route(private_kernel_pfkey_ipsec_t *this,
.dst_net = chunk_clone(policy->src.net->get_address(policy->src.net)), .dst_net = chunk_clone(policy->src.net->get_address(policy->src.net)),
); );
/* if the IP is virtual, we install the route over the interface it has
* been installed on. Otherwise we use the interface we use for IKE, as
* this is required for example on Linux. */
if (is_virtual)
{
src = route->src_ip;
}
/* get interface for route, using source address */ /* get interface for route, using source address */
if (!hydra->kernel_interface->get_interface(hydra->kernel_interface, if (!hydra->kernel_interface->get_interface(hydra->kernel_interface,
src, &route->if_name)) src, &route->if_name))