denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Fail route installation if remote TS matches peer

Browse Source
This commit is contained in:
Tobias Brunner
2013-07-18 15:41:36 +02:00
parent 29bdfb4086
commit e5b5a66712
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+8
View File
@@ -2148,6 +2148,14 @@ static bool install_route(private_kernel_pfkey_ipsec_t *this,
if (hydra->kernel_interface->get_features( if (hydra->kernel_interface->get_features(
hydra->kernel_interface) & KERNEL_REQUIRE_EXCLUDE_ROUTE) hydra->kernel_interface) & KERNEL_REQUIRE_EXCLUDE_ROUTE)
{ {
if (in->src_ts->is_host(in->src_ts, dst))
{
DBG1(DBG_KNL, "can't install route for %R === %R %N, conflicts "
"with IKE traffic", in->src_ts, in->dst_ts, policy_dir_names,
policy->direction);
route_entry_destroy(route);
return FALSE;
}
if (in->src_ts->includes(in->src_ts, dst)) if (in->src_ts->includes(in->src_ts, dst))
{ {
add_exclude_route(this, route, in->generic.sa->dst, dst); add_exclude_route(this, route, in->generic.sa->dst, dst);