denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Document ICMP type/code traffic selector restrictions

Browse Source
This commit is contained in:
Tobias Brunner
2025-03-05 10:55:51 +01:00
parent 3c3a545bfe
commit fcaee9e123
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+4
View File
@@ -780,6 +780,10 @@ connections.<conn>.children.<child>.local_ts = dynamic
restriction may be numeric, a **getservent**(3) service name, or the special restriction may be numeric, a **getservent**(3) service name, or the special
value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
as well, none of the kernel backends currently support port ranges, though. as well, none of the kernel backends currently support port ranges, though.
If the protocol is _icmp_ or _ipv6-icmp_, the port is interpreted as ICMP
message type if it is less than 256 or as type and code if it is greater or
equal to 256, with the type in the most significant 8 bits and the code in
the least significant 8 bits.
When IKEv1 is used only the first selector is interpreted, except if When IKEv1 is used only the first selector is interpreted, except if
the Cisco Unity extension plugin is used. This is due to a limitation of the the Cisco Unity extension plugin is used. This is due to a limitation of the