denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Only associate templates with inbound FWD policies

Browse Source 
We can't set a template on the outbound FWD policy (or we'd have to make
it optional).  Because if the traffic does not come from another (matching)
IPsec tunnel it would get dropped due to the template mismatch.
This commit is contained in:
Tobias Brunner
2016-04-09 16:51:00 +02:00
committed by Andreas Steffen
parent 9c12635252
commit f7e9e6a3fd
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+1 -1
View File
@@ -2156,7 +2156,7 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
policy_info->lft.soft_use_expires_seconds = 0;
policy_info->lft.hard_use_expires_seconds = 0;
if (mapping->type == POLICY_IPSEC)
if (mapping->type == POLICY_IPSEC && ipsec->cfg.reqid)
{
struct xfrm_user_tmpl *tmpl;
struct {