Merge branch 'vip-shunts'

Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c

src/libcharon/plugins/unity/unity_handler.c

@@ -174,7 +174,6 @@ static job_requeue_t add_exclude_async(entry_t *entry)
 	ike_sa_t *ike_sa;
 	char name[128];
 	host_t *host;
-	bool has_vip = FALSE;
 
 	ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
 													entry->sa, FALSE);
@@ -187,25 +186,21 @@ static job_requeue_t add_exclude_async(entry_t *entry)
 									 FALSE, 0, 0, NULL, NULL, FALSE);
 		child_cfg->add_traffic_selector(child_cfg, FALSE,
 										entry->ts->clone(entry->ts));
+		host = ike_sa->get_my_host(ike_sa);
+		child_cfg->add_traffic_selector(child_cfg, TRUE,
+				traffic_selector_create_from_subnet(host->clone(host),
+													32, 0, 0, 65535));
+		charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+
 		enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, TRUE);
 		while (enumerator->enumerate(enumerator, &host))
 		{
-			has_vip = TRUE;
 			child_cfg->add_traffic_selector(child_cfg, TRUE,
 				traffic_selector_create_from_subnet(host->clone(host),
 													32, 0, 0, 65535));
 		}
 		enumerator->destroy(enumerator);
 
-		if (!has_vip)
-		{
-			host = ike_sa->get_my_host(ike_sa);
-			child_cfg->add_traffic_selector(child_cfg, TRUE,
-				traffic_selector_create_from_subnet(host->clone(host), 32, 0,
-													0, 65535));
-		}
-		charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-
 		charon->shunts->install(charon->shunts, child_cfg);
 		child_cfg->destroy(child_cfg);
 

src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c

@@ -2202,14 +2202,15 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
 
 	/* install a route, if:
 	 * - this is a forward policy (to just get one for each child)
-	 * - we are in tunnel/BEET mode
+	 * - we are in tunnel/BEET mode or install a bypass policy
 	 * - routing is not disabled via strongswan.conf
 	 */
-	if (policy->direction == POLICY_FWD &&
+	if (policy->direction == POLICY_FWD && this->install_routes &&
-		ipsec->cfg.mode != MODE_TRANSPORT && this->install_routes)
+		(mapping->type != POLICY_IPSEC || ipsec->cfg.mode != MODE_TRANSPORT))
 	{
 		policy_sa_fwd_t *fwd = (policy_sa_fwd_t*)mapping;
 		route_entry_t *route;
+		host_t *iface;
 
 		INIT(route,
 			.prefixlen = policy->sel.prefixlen_s,
@@ -2225,9 +2226,17 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
 			route->dst_net = chunk_alloc(policy->sel.family == AF_INET ? 4 : 16);
 			memcpy(route->dst_net.ptr, &policy->sel.saddr, route->dst_net.len);
 
+			/* get the interface to install the route for. If we have a local
+			 * address, use it. Otherwise (for shunt policies) use the
+			 * routes source address. */
+			iface = ipsec->dst;
+			if (iface->is_anyaddr(iface))
+			{
+				iface = route->src_ip;
+			}
 			/* install route via outgoing interface */
 			if (!hydra->kernel_interface->get_interface(hydra->kernel_interface,
-												ipsec->dst, &route->if_name))
+														iface, &route->if_name))
 			{
 				this->mutex->unlock(this->mutex);
 				route_entry_destroy(route);