kernel-ipsec: Add flags to enable ICMP error forwarding

For the Linux kernel, this has to be enabled on the inbound SA and the
out and fwd policies.

diff --git a/src/libcharon/kernel/kernel_ipsec.h b/src/libcharon/kernel/kernel_ipsec.h
index 70ff2eb12d2625f8d732a217d2975eff97dab089..094c90d3ce169d1d391602f00776e0e72aaef948 100644 (file)
--- a/src/libcharon/kernel/kernel_ipsec.h
+++ b/src/libcharon/kernel/kernel_ipsec.h
@@ -105,6 +105,8 @@ struct kernel_ipsec_add_sa_t {
        bool copy_ecn;
        /** Whether to copy the DSCP header field to/from the outer header */
        dscp_copy_t copy_dscp;
+       /** Whether to automatically forward certain ICMP error messages */
+       bool forward_icmp;
        /** TRUE if initiator of the exchange creating the SA */
        bool initiator;
        /** TRUE if this is an inbound SA */

diff --git a/src/libstrongswan/ipsec/ipsec_types.c b/src/libstrongswan/ipsec/ipsec_types.c
index 0c581388f1a42688144e8959b441338764ef222f..98957c30a7f9b187dc529481a53b6c6f4016fb3d 100644 (file)
--- a/src/libstrongswan/ipsec/ipsec_types.c
+++ b/src/libstrongswan/ipsec/ipsec_types.c
@@ -58,12 +58,13 @@ u_int ipsec_sa_cfg_hash(ipsec_sa_cfg_t *this)
        return chunk_hash_inc(chunk_from_thing(this->mode),
                        chunk_hash_inc(chunk_from_thing(this->reqid),
                        chunk_hash_inc(chunk_from_thing(this->policy_count),
+                       chunk_hash_inc(chunk_from_thing(this->forward_icmp),
                        chunk_hash_inc(chunk_from_thing(this->esp.use),
                        chunk_hash_inc(chunk_from_thing(this->esp.spi),
                        chunk_hash_inc(chunk_from_thing(this->ah.use),
                        chunk_hash_inc(chunk_from_thing(this->ah.spi),
                        chunk_hash_inc(chunk_from_thing(this->ipcomp.transform),
-                               chunk_hash(chunk_from_thing(this->ipcomp.cpi))))))))));
+                               chunk_hash(chunk_from_thing(this->ipcomp.cpi)))))))))));
 }
 
 /*
@@ -74,6 +75,7 @@ bool ipsec_sa_cfg_equals(ipsec_sa_cfg_t *a, ipsec_sa_cfg_t *b)
        return a->mode == b->mode &&
                a->reqid == b->reqid &&
                a->policy_count == b->policy_count &&
+               a->forward_icmp == b->forward_icmp &&
                a->esp.use == b->esp.use &&
                a->esp.spi == b->esp.spi &&
                a->ah.use == b->ah.use &&

diff --git a/src/libstrongswan/ipsec/ipsec_types.h b/src/libstrongswan/ipsec/ipsec_types.h
index 6aa29bdf10b1852ac483dadd8660d1d14a1e3afc..6b407e8670d0731f58462c6171e1adfe105eb30d 100644 (file)
--- a/src/libstrongswan/ipsec/ipsec_types.h
+++ b/src/libstrongswan/ipsec/ipsec_types.h
@@ -159,6 +159,8 @@ struct ipsec_sa_cfg_t {
        uint32_t reqid;
        /** number of policies of the same kind (in/out/fwd) attached to SA */
        uint32_t policy_count;
+       /** whether SA is to forward certain ICMP error messages automatically */
+       bool forward_icmp;
        /** details about ESP/AH */
        struct {
                /** TRUE if this protocol is used */