sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity

kernel-pfroute: add a feature flag requesting "exclude" routes

Browse Source 
If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.
This commit is contained in:
Martin Willi 2013-04-20 12:28:05 +02:00
parent bd520193a4
commit 580b768d03
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libhydra/kernel/kernel_interface.h
View File

@ -65,6 +65,8 @@ typedef enum kernel_feature_t kernel_feature_t;
enum kernel_feature_t {
/** IPsec can process ESPv3 (RFC 4303) TFC padded packets */
KERNEL_ESP_V3_TFC = (1<<0),
/** Networking requires an "exclude" route for IKE/ESP packets */
KERNEL_REQUIRE_EXCLUDE_ROUTE = (1<<1),
};
/**

7
src/libhydra/plugins/kernel_pfroute/kernel_pfroute_net.c
View File

@ -770,6 +770,12 @@ METHOD(kernel_net_t, create_address_enumerator, enumerator_t*,
(void*)address_enumerator_destroy);
}
METHOD(kernel_net_t, get_features, kernel_feature_t,
private_kernel_pfroute_net_t *this)
{
return KERNEL_REQUIRE_EXCLUDE_ROUTE;
}
METHOD(kernel_net_t, get_interface_name, bool,
private_kernel_pfroute_net_t *this, host_t* ip, char **name)
{
@ -1276,6 +1282,7 @@ kernel_pfroute_net_t *kernel_pfroute_net_create()
INIT(this,
.public = {
.interface = {
.get_features = _get_features,
.get_interface = _get_interface_name,
.create_address_enumerator = _create_address_enumerator,
.get_source_addr = _get_source_addr,