denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec-types: Support the %unique mark value

Browse Source
This commit is contained in:
Martin Willi
2015-02-20 16:34:53 +01:00
parent b8973b2661
commit cc1682bef9
3 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+3 -1
View File
@@ -987,7 +987,9 @@ sets an XFRM mark in the inbound and outbound
IPsec SAs and policies. If the mask is missing then a default
mask of
.B 0xffffffff
is assumed.
is assumed. The special value
.B %unique
assigns a unique value to each newly created IPsec SA.
.TP
.BR mark_in " = <value>[/<mask>]"
sets an XFRM mark in the inbound IPsec SA and
src/libstrongswan/ipsec/ipsec_types.c
+9 -1
View File
@@ -48,7 +48,15 @@ bool mark_from_string(const char *value, mark_t *mark)
{
return FALSE;
}
mark->value = strtoul(value, &endptr, 0);
if (strcasepfx(value, "%unique"))
{
mark->value = MARK_UNIQUE;
endptr = (char*)value + strlen("%unique");
}
else
{
mark->value = strtoul(value, &endptr, 0);
}
if (*endptr)
{
if (*endptr != '/')
src/swanctl/swanctl.opt
+6 -4
View File
@@ -622,9 +622,10 @@ connections.<conn>.children.<child>.reqid = 0
connections.<conn>.children.<child>.mark_in = 0/0x00000000
Netfilter mark and mask for input traffic.
Netfilter mark and mask for input traffic. On Linux Netfilter may apply
marks to each packet coming from a tunnel having that option set. The
mark may then be used by Netfilter to match rules.
Netfilter mark and mask for input traffic. On Linux Netfilter may require
marks on each packet to match an SA having that option set. This allows
Netfilter rules to select specific tunnels for incoming traffic. The
special value _%unique_ sets a unique mark on each CHILD_SA instance.
An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff.
@@ -634,7 +635,8 @@ connections.<conn>.children.<child>.mark_out = 0/0x00000000
Netfilter mark and mask for output traffic. On Linux Netfilter may require
marks on each packet to match a policy having that option set. This allows
Netfilter rules to select specific tunnels for outgoing traffic.
Netfilter rules to select specific tunnels for outgoing traffic. The
special value _%unique_ sets a unique mark on each CHILD_SA instance.
An additional mask may be appended to the mark, separated by _/_. The
default mask if omitted is 0xffffffff.