diff options
| author | Martin Willi <martin@revosec.ch> | 2013-12-11 15:57:46 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-06-04 16:32:07 +0200 |
| commit | 7452adfad38f36f2996057237e5588c75dba0766 (patch) | |
| tree | 5d2d125777930c413d7d29318bbdc7d1d26e3239 /src/libcharon/sa | |
| parent | cd88f818fa48da9797910653c97bdb4ffc9fd0c5 (diff) | |
| download | strongswan-7452adfad38f36f2996057237e5588c75dba0766.tar.bz2 strongswan-7452adfad38f36f2996057237e5588c75dba0766.tar.xz | |
kernel-interface: Add a flag to indicate no policy updates required
Diffstat (limited to 'src/libcharon/sa')
| -rw-r--r-- | src/libcharon/sa/child_sa.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c index 847cfc78f..bbf6259c2 100644 --- a/src/libcharon/sa/child_sa.c +++ b/src/libcharon/sa/child_sa.c @@ -731,6 +731,17 @@ METHOD(child_sa_t, install, status_t, } /** + * Check kernel interface if policy updates are required + */ +static bool require_policy_update() +{ + kernel_feature_t f; + + f = hydra->kernel_interface->get_features(hydra->kernel_interface); + return !(f & KERNEL_NO_POLICY_UPDATES); +} + +/** * Install 3 policies: out, in and forward */ static status_t install_policies_internal(private_child_sa_t *this, @@ -842,7 +853,7 @@ METHOD(child_sa_t, add_policies, status_t, { /* install outbound drop policy to avoid packets leaving unencrypted * when updating policies */ - if (priority == POLICY_PRIORITY_DEFAULT) + if (priority == POLICY_PRIORITY_DEFAULT && require_policy_update()) { status |= install_policies_internal(this, this->my_addr, this->other_addr, my_ts, other_ts, @@ -936,7 +947,7 @@ METHOD(child_sa_t, update, status_t, } } - if (this->config->install_policy(this->config)) + if (this->config->install_policy(this->config) && require_policy_update()) { ipsec_sa_cfg_t my_sa = { .mode = this->mode, @@ -1075,7 +1086,7 @@ METHOD(child_sa_t, destroy, void, while (enumerator->enumerate(enumerator, &my_ts, &other_ts)) { del_policies_internal(this, my_ts, other_ts, priority); - if (priority == POLICY_PRIORITY_DEFAULT) + if (priority == POLICY_PRIORITY_DEFAULT && require_policy_update()) { del_policies_internal(this, my_ts, other_ts, POLICY_PRIORITY_FALLBACK); |