denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Suppress NAT mapping updates for per-CPU SAs

Browse Source 
As we set the remote port to 0, we'd get a mapping change message with
every packet. Setting the threshold avoids all kernel messages after the
first, which we suppress explicitly as well.
This commit is contained in:
Tobias Brunner
2025-05-28 16:35:27 +02:00
parent 14e1ec2b77
commit d83fbe82e4
1 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+19
View File
@@ -1160,6 +1160,15 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
dst = xfrm2host(mapping->id.family, &mapping->id.daddr, 0); dst = xfrm2host(mapping->id.family, &mapping->id.daddr, 0);
if (dst) if (dst)
{
if (!mapping->old_sport)
{
/* ignore mappings for per-CPU SAs with 0 source port */
DBG1(DBG_KNL, "ignore NAT mapping change for per-resource "
"CHILD_SA %N/0x%08x/%H", protocol_id_names, PROTO_ESP,
htonl(spi), dst);
}
else
{ {
new = xfrm2host(mapping->id.family, &mapping->new_saddr, new = xfrm2host(mapping->id.family, &mapping->new_saddr,
mapping->new_sport); mapping->new_sport);
@@ -1169,6 +1178,7 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
new); new);
new->destroy(new); new->destroy(new);
} }
}
dst->destroy(dst); dst->destroy(dst);
} }
} }
@@ -2053,6 +2063,15 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
* No. The reason the kernel ignores NAT-OA is that it recomputes * No. The reason the kernel ignores NAT-OA is that it recomputes
* (or, rather, just ignores) the checksum. If packets pass the IPsec * (or, rather, just ignores) the checksum. If packets pass the IPsec
* checks it marks them "checksum ok" so OA isn't needed. */ * checks it marks them "checksum ok" so OA isn't needed. */
/* if the remote port is set to 0 for UDP-encapsulated per-CPU SAs, we
* increase the treshold for mapping changes as it gets otherwise
* triggered with every packet */
if (data->inbound && !id->src->get_port(id->src) &&
!add_uint32(hdr, sizeof(request), XFRMA_MTIMER_THRESH, UINT32_MAX))
{
goto failed;
}
} }
if (!add_mark(hdr, sizeof(request), id->mark)) if (!add_mark(hdr, sizeof(request), id->mark))