denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-libipsec: Add an option to allow remote TS to match the IKE peer

Browse Source 
Setting the fwmark options for the kernel-netlink and socket-default
plugins allow this kind of setup.

It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make
it work.
This commit is contained in:
Tobias Brunner
2013-10-11 15:32:44 +02:00
parent 80f8b3a6d8
commit eeb34af069
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/strongswan.conf.5.in
+7
View File
@@ -623,6 +623,13 @@ Number of ipsecN devices
.BR charon.plugins.kernel-klips.ipsec_dev_mtu " [0]"
Set MTU of ipsecN device
.TP
.BR charon.plugins.kernel-libipsec.allow_peer_ts " [no]"
Allow that the remote traffic selector equals the IKE peer. The route installed
for such traffic (via TUN device) usually prevents further IKE traffic. The
fwmark options for the \fIkernel-netlink\fR and \fIsocket-default\fR plugins can
be used to circumvent that problem.
to
.TP
.BR charon.plugins.kernel-netlink.fwmark
Firewall mark to set on the routing rule that directs traffic to our own routing
table. The format is [!]mark[/mask], where the optional exclamation mark inverts
src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
+9 -2
View File
@@ -50,6 +50,11 @@ struct private_kernel_libipsec_ipsec_t {
* List of exclude routes (exclude_route_t)
*/
linked_list_t *excludes;
/**
* Whether the remote TS may equal the IKE peer
*/
bool allow_peer_ts;
};
typedef struct exclude_route_t exclude_route_t;
@@ -465,7 +470,7 @@ static bool install_route(private_kernel_libipsec_ipsec_t *this,
policy->route = NULL;
}
if (dst_ts->is_host(dst_ts, dst))
if (!this->allow_peer_ts && dst_ts->is_host(dst_ts, dst))
{
DBG1(DBG_KNL, "can't install route for %R === %R %N, conflicts with "
"IKE traffic", src_ts, dst_ts, policy_dir_names,
@@ -475,7 +480,7 @@ static bool install_route(private_kernel_libipsec_ipsec_t *this,
return FALSE;
}
/* if remote traffic selector covers the IKE peer, add an exclude route */
if (dst_ts->includes(dst_ts, dst))
if (!this->allow_peer_ts && dst_ts->includes(dst_ts, dst))
{
/* add exclude route for peer */
add_exclude_route(this, route, src, dst);
@@ -694,6 +699,8 @@ kernel_libipsec_ipsec_t *kernel_libipsec_ipsec_create()
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
.policies = linked_list_create(),
.excludes = linked_list_create(),
.allow_peer_ts = lib->settings->get_bool(lib->settings,
"%s.plugins.kernel-libipsec.allow_peer_ts", FALSE, hydra->daemon),
);
ipsec->events->register_listener(ipsec->events, &this->ipsec_listener);