denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Use interface to next hop for shunt policies

Browse Source 
Using the source address to determine the interface is not correct for
net-to-net shunts between two interfaces on which the host has IP addresses
for each subnet.
This commit is contained in:
Tobias Brunner
2016-06-10 13:57:27 +02:00
parent 66e9165bc6
commit 4ba5ea407b
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+13 -10
View File
@@ -2335,19 +2335,22 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
/* get the interface to install the route for. If we have a local
* address, use it. Otherwise (for shunt policies) use the
* routes source address. */
* route's source address. */
iface = ipsec->dst;
if (iface->is_anyaddr(iface))
{
iface = route->src_ip;
}
/* install route via outgoing interface */
if (!charon->kernel->get_interface(charon->kernel, iface,
&route->if_name))
{
policy_change_done(this, policy);
route_entry_destroy(route);
return SUCCESS;
iface = ipsec->dst;
if (iface->is_anyaddr(iface))
{
iface = route->src_ip;
}
if (!charon->kernel->get_interface(charon->kernel, iface,
&route->if_name))
{
policy_change_done(this, policy);
route_entry_destroy(route);
return SUCCESS;
}
}
if (policy->route)