denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-libipsec: Add support to send/receive raw ESP packets

Browse Source 
This is currently only supported on Linux and with the appropriate
permissions.

Since it's experimental, it's disabled by default.

The log messages for each sent and received ESP message are logged in NET
like the ones in the socket-default plugin for UDP-encapsulated messages.
This commit is contained in:
Tobias Brunner
2023-05-23 13:19:47 +02:00
parent 29e8cb3f90
commit e306fa5f73
7 changed files with 469 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/kernel-libipsec.opt
+7
View File
@@ -5,3 +5,10 @@ charon.plugins.kernel-libipsec.allow_peer_ts = no
installed for such traffic (via TUN device) usually prevents further IKE
traffic. The fwmark options for the _kernel-netlink_ and _socket-default_
plugins can be used to circumvent that problem.
charon.plugins.kernel-libipsec.fwmark = charon.plugins.socket-default.fwmark
Firewall mark to set on outbound raw ESP packets.
charon.plugins.kernel-libipsec.raw_esp = no
Whether to send and receive ESP packets without UDP encapsulation if
supported on this platform and no NAT is detected.