kernel-netlink: Optionally install protocol and ports on transport mode SAs

diff --git a/conf/plugins/kernel-netlink.opt b/conf/plugins/kernel-netlink.opt
index 2a755db22dca989289d00d33b16249b6329a3d39..7d44581a53a8635a791727229d8c615bd272408e 100644 (file)
--- a/conf/plugins/kernel-netlink.opt
+++ b/conf/plugins/kernel-netlink.opt
@@ -16,6 +16,15 @@ charon.plugins.kernel-netlink.mtu = 0
 charon.plugins.kernel-netlink.roam_events = yes
        Whether to trigger roam events when interfaces, addresses or routes change.
 
+charon.plugins.kernel-netlink.set_proto_port_transport_sa = no
+       Whether to set protocol and ports in the selector installed on transport
+       mode IPsec SAs in the kernel.
+
+       Whether to set protocol and ports in the selector installed on transport
+       mode IPsec SAs in the kernel. While doing so enforces policies for inbound
+       traffic, it also prevents the use of a single IPsec SA by more than one
+       traffic selector.
+
 charon.plugins.kernel-netlink.xfrm_acq_expires = 165
        Lifetime of XFRM acquire state in kernel.
 

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
index d9b55cfa76e648878dda14a04f2bf5907f2a39f3..274af7954aa28de6421940e43525dc221b925bc1 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -309,6 +309,12 @@ struct private_kernel_netlink_ipsec_t {
         */
        bool install_routes;
 
+       /**
+        * Whether to set protocol and ports on selector installed with transport
+        * mode IPsec SAs
+        */
+       bool proto_port_transport;
+
        /**
         * Whether to track the history of a policy
         */
@@ -1235,12 +1241,15 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
                        if (src_ts && dst_ts)
                        {
                                sa->sel = ts2selector(src_ts, dst_ts);
-                               /* don't install proto/port on SA. This would break
-                                * potential secondary SAs for the same address using a
-                                * different prot/port. */
-                               sa->sel.proto = 0;
-                               sa->sel.dport = sa->sel.dport_mask = 0;
-                               sa->sel.sport = sa->sel.sport_mask = 0;
+                               if (!this->proto_port_transport)
+                               {
+                                       /* don't install proto/port on SA. This would break
+                                        * potential secondary SAs for the same address using a
+                                        * different prot/port. */
+                                       sa->sel.proto = 0;
+                                       sa->sel.dport = sa->sel.dport_mask = 0;
+                                       sa->sel.sport = sa->sel.sport_mask = 0;
+                               }
                        }
                        break;
                default:
@@ -2683,6 +2692,9 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
                .policy_history = TRUE,
                .install_routes = lib->settings->get_bool(lib->settings,
                                                        "%s.install_routes", TRUE, lib->ns),
+               .proto_port_transport = lib->settings->get_bool(lib->settings,
+                                               "%s.plugins.kernel-netlink.set_proto_port_transport_sa",
+                                               FALSE, lib->ns),
        );
 
        if (streq(lib->ns, "starter"))