sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-06 00:00:47 -04:00
Code Issues Projects Releases Wiki Activity

kernel-netlink: Selectively add selector on SAs that use IPComp

Browse Source 
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
This commit is contained in:
Tobias Brunner 2013-11-07 20:58:42 +01:00
parent 7e3bbcf77a
commit cc04a6db3e
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
View File

@ -1203,6 +1203,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
struct nlmsghdr *hdr;
struct xfrm_usersa_info *sa;
u_int16_t icv_size = 64;
ipsec_mode_t original_mode = mode;
status_t status = FAILED;
/* if IPComp is used, we install an additional IPComp SA. if the cpi is 0
@ -1243,7 +1244,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
break;
case MODE_BEET:
case MODE_TRANSPORT:
if(src_ts && dst_ts)
if (original_mode == MODE_TUNNEL)
{ /* don't install selectors for switched SAs. because only one
* selector can be installed other traffic would get dropped */
break;
}
if (src_ts && dst_ts)
{
sa->sel = ts2selector(src_ts, dst_ts);
/* don't install proto/port on SA. This would break