diff options
| author | Martin Willi <martin@revosec.ch> | 2013-12-11 16:02:11 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-06-04 16:32:07 +0200 |
| commit | b93492980489fa4ef0664c0ac4669592537ce1c2 (patch) | |
| tree | c977b7a0107331d484126edb0f3b3e8a6ff63c22 /src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c | |
| parent | 7452adfad38f36f2996057237e5588c75dba0766 (diff) | |
| download | strongswan-b93492980489fa4ef0664c0ac4669592537ce1c2.tar.bz2 strongswan-b93492980489fa4ef0664c0ac4669592537ce1c2.tar.xz | |
kernel-wfp: Disable IPsec policy updates
It seems that WFP requires an update of the SA context only, but not for the
filters. This allows us to omit support for (fallback) drop policies.
Diffstat (limited to 'src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c')
| -rw-r--r-- | src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c index 9073dec33..a7d8a9839 100644 --- a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c +++ b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c @@ -996,7 +996,7 @@ static bool install(private_kernel_wfp_ipsec_t *this, entry_t *entry) METHOD(kernel_ipsec_t, get_features, kernel_feature_t, private_kernel_wfp_ipsec_t *this) { - return KERNEL_ESP_V3_TFC; + return KERNEL_ESP_V3_TFC | KERNEL_NO_POLICY_UPDATES; } METHOD(kernel_ipsec_t, get_spi, status_t, @@ -1281,6 +1281,15 @@ METHOD(kernel_ipsec_t, add_policy, status_t, return NOT_SUPPORTED; } + switch (type) + { + case POLICY_IPSEC: + break; + case POLICY_PASS: + case POLICY_DROP: + return NOT_SUPPORTED; + } + switch (direction) { case POLICY_OUT: @@ -1297,11 +1306,9 @@ METHOD(kernel_ipsec_t, add_policy, status_t, { case POLICY_PRIORITY_DEFAULT: break; - case POLICY_PRIORITY_FALLBACK: - /* TODO: install fallback policy? */ - return SUCCESS; case POLICY_PRIORITY_ROUTED: /* TODO: install trap policy with low prio */ + case POLICY_PRIORITY_FALLBACK: default: return NOT_SUPPORTED; } |