diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2014-01-23 10:27:49 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2014-01-23 10:31:04 +0100 |
| commit | 6b95565767038eef1fb07a42bef43690009827c5 (patch) | |
| tree | d5c4c09c6ee9384e4473a78fc024b9a1ec4e1b2a /src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | |
| parent | 72a92d4f7d07980dfadb1ebaca740ec50364d33d (diff) | |
| parent | 571025a6092e30d7839d9c78df9b8bf40084319b (diff) | |
| download | strongswan-6b95565767038eef1fb07a42bef43690009827c5.tar.bz2 strongswan-6b95565767038eef1fb07a42bef43690009827c5.tar.xz | |
Merge branch 'ipcomp'
Fixes compatibility issues between firewall rules (leftfirewall=yes)
and IPComp (compress=yes), plus issues with IPComp when used with
multiple subnets in left|rightsubnet.
Fixes #436.
Diffstat (limited to 'src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c')
| -rw-r--r-- | src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c index 128e6571c..24f15d9a1 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -1203,6 +1203,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, struct nlmsghdr *hdr; struct xfrm_usersa_info *sa; u_int16_t icv_size = 64; + ipsec_mode_t original_mode = mode; status_t status = FAILED; /* if IPComp is used, we install an additional IPComp SA. if the cpi is 0 @@ -1213,7 +1214,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, mark, tfc, &lft, ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED, chunk_empty, mode, ipcomp, 0, initiator, FALSE, FALSE, inbound, - NULL, NULL); + src_ts, dst_ts); ipcomp = IPCOMP_NONE; /* use transport mode ESP SA, IPComp uses tunnel mode */ mode = MODE_TRANSPORT; @@ -1243,7 +1244,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t, break; case MODE_BEET: case MODE_TRANSPORT: - if(src_ts && dst_ts) + if (original_mode == MODE_TUNNEL) + { /* don't install selectors for switched SAs. because only one + * selector can be installed other traffic would get dropped */ + break; + } + if (src_ts && dst_ts) { sa->sel = ts2selector(src_ts, dst_ts); /* don't install proto/port on SA. This would break |