From d7a59f1976f1d917f5cc934a95f1a809148cb160 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 27 Jul 2011 13:44:33 +0200 Subject: Install fallback drop policies to avoid transmitting unencrypted packets. During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy is first uninstalled and then the new one is installed. In the short time in between, where no policy is available in the kernel, unencrypted packets could have been transmitted. --- src/libhydra/kernel/kernel_ipsec.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/libhydra/kernel/kernel_ipsec.h') diff --git a/src/libhydra/kernel/kernel_ipsec.h b/src/libhydra/kernel/kernel_ipsec.h index 375945917..986e21fca 100644 --- a/src/libhydra/kernel/kernel_ipsec.h +++ b/src/libhydra/kernel/kernel_ipsec.h @@ -98,6 +98,8 @@ enum policy_priority_t { POLICY_PRIORITY_DEFAULT, /** Priority for trap policies */ POLICY_PRIORITY_ROUTED, + /** Priority for fallback drop policies */ + POLICY_PRIORITY_FALLBACK, }; /** -- cgit v1.2.3