denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Suppress NAT mapping updates for per-CPU SAs

Browse Source 
As we set the remote port to 0, we'd get a mapping change message with
every packet. Setting the threshold avoids all kernel messages after the
first, which we suppress explicitly as well.
This commit is contained in:
Tobias Brunner
2025-05-28 16:35:27 +02:00
parent 14e1ec2b77
commit d83fbe82e4
1 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+25 -6
View File
@@ -1161,13 +1161,23 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
dst = xfrm2host(mapping->id.family, &mapping->id.daddr, 0); dst = xfrm2host(mapping->id.family, &mapping->id.daddr, 0);
if (dst) if (dst)
{ {
new = xfrm2host(mapping->id.family, &mapping->new_saddr, if (!mapping->old_sport)
mapping->new_sport);
if (new)
{ {
charon->kernel->mapping(charon->kernel, IPPROTO_ESP, spi, dst, /* ignore mappings for per-CPU SAs with 0 source port */
new); DBG1(DBG_KNL, "ignore NAT mapping change for per-resource "
new->destroy(new); "CHILD_SA %N/0x%08x/%H", protocol_id_names, PROTO_ESP,
htonl(spi), dst);
}
else
{
new = xfrm2host(mapping->id.family, &mapping->new_saddr,
mapping->new_sport);
if (new)
{
charon->kernel->mapping(charon->kernel, IPPROTO_ESP, spi, dst,
new);
new->destroy(new);
}
} }
dst->destroy(dst); dst->destroy(dst);
} }
@@ -2053,6 +2063,15 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
* No. The reason the kernel ignores NAT-OA is that it recomputes * No. The reason the kernel ignores NAT-OA is that it recomputes
* (or, rather, just ignores) the checksum. If packets pass the IPsec * (or, rather, just ignores) the checksum. If packets pass the IPsec
* checks it marks them "checksum ok" so OA isn't needed. */ * checks it marks them "checksum ok" so OA isn't needed. */
/* if the remote port is set to 0 for UDP-encapsulated per-CPU SAs, we
* increase the treshold for mapping changes as it gets otherwise
* triggered with every packet */
if (data->inbound && !id->src->get_port(id->src) &&
!add_uint32(hdr, sizeof(request), XFRMA_MTIMER_THRESH, UINT32_MAX))
{
goto failed;
}
} }
if (!add_mark(hdr, sizeof(request), id->mark)) if (!add_mark(hdr, sizeof(request), id->mark))