denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Don't install exclude routes for locally connected peers

Browse Source 
Such routes with a gateway that equals the peer's address are problematic
on FreeBSD.  And since there is most likely a narrow route for the local
subnet anyway, the exclude routes would be redundant.
This commit is contained in:
Tobias Brunner
2022-03-15 13:52:24 +01:00
parent 5de6ab82a6
commit 8a76c5af8a
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+7 -2
View File
@@ -2339,8 +2339,13 @@ static void add_exclude_route(private_kernel_pfkey_ipsec_t *this,
{
char *if_name = NULL;
if (charon->kernel->get_interface(charon->kernel, src, &if_name) &&
charon->kernel->add_route(charon->kernel,
if (gtw->ip_equals(gtw, dst))
{
DBG1(DBG_KNL, "not installing exclude route for directly "
"connected peer %H", dst);
}
else if (charon->kernel->get_interface(charon->kernel, src, &if_name) &&
charon->kernel->add_route(charon->kernel,
dst->get_address(dst),
dst->get_family(dst) == AF_INET ? 32 : 128,
gtw, src, if_name, FALSE) == SUCCESS)