diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2013-10-17 16:29:30 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-10-17 16:57:39 +0200 |
| commit | 4c185d11add87c1f0b11be9a46097446d0a6ca2d (patch) | |
| tree | fbc3b6ce94ed87e3bb70762ab04f59b6383ca185 /src | |
| parent | 9739a0bf670095b9ea1ed4d22694f3de04a3d5be (diff) | |
| download | strongswan-4c185d11add87c1f0b11be9a46097446d0a6ca2d.tar.bz2 strongswan-4c185d11add87c1f0b11be9a46097446d0a6ca2d.tar.xz | |
updown: Properly configure ICMP[v6] message type and code in firewall rules
Diffstat (limited to 'src')
| -rw-r--r-- | src/_updown/_updown.in | 33 |
1 files changed, 29 insertions, 4 deletions
diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in index 72ec7d246..c68c23d8a 100644 --- a/src/_updown/_updown.in +++ b/src/_updown/_updown.in @@ -290,16 +290,41 @@ else IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out" fi +# use protocol specific options to set ports +case "$PLUTO_MY_PROTOCOL" in +1) # ICMP + ICMP_TYPE_OPTION="--icmp-type" + ;; +58) # ICMPv6 + ICMP_TYPE_OPTION="--icmpv6-type" + ;; +*) + ;; +esac + # are there port numbers? if [ "$PLUTO_MY_PORT" != 0 ] then - S_MY_PORT="--sport $PLUTO_MY_PORT" - D_MY_PORT="--dport $PLUTO_MY_PORT" + if [ -n "$ICMP_TYPE_OPTION" ] + then + S_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT" + D_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT" + else + S_MY_PORT="--sport $PLUTO_MY_PORT" + D_MY_PORT="--dport $PLUTO_MY_PORT" + fi fi if [ "$PLUTO_PEER_PORT" != 0 ] then - S_PEER_PORT="--sport $PLUTO_PEER_PORT" - D_PEER_PORT="--dport $PLUTO_PEER_PORT" + if [ -n "$ICMP_TYPE_OPTION" ] + then + # the syntax is --icmp[v6]-type type[/code], so add it to the existing option + S_MY_PORT="$S_MY_PORT/$PLUTO_PEER_PORT" + D_MY_PORT="$D_MY_PORT/$PLUTO_PEER_PORT" + else + S_PEER_PORT="--sport $PLUTO_PEER_PORT" + D_PEER_PORT="--dport $PLUTO_PEER_PORT" + fi fi # resolve octal escape sequences |