{
free(this->if_name);
this->src_ip->destroy(this->src_ip);
- this->gateway->destroy(this->gateway);
+ DESTROY_IF(this->gateway);
chunk_free(&this->dst_net);
free(this);
}
* - we are NOT updating a policy
* - this is a forward policy (to just get one for each child)
* - we are in tunnel mode
- * - we are not using IPv6 (does not work correctly yet!)
* - routing is not disabled via strongswan.conf
*/
if (policy->route == NULL && direction == POLICY_FWD &&
- mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 &&
- this->install_routes)
+ mode != MODE_TRANSPORT && this->install_routes)
{
route_entry_t *route = malloc_thing(route_entry_t);
if (charon->kernel_interface->get_address_by_ts(charon->kernel_interface,
dst_ts, &route->src_ip) == SUCCESS)
{
- /* get the nexthop to src (src as we are in POLICY_FWD).*/
- route->gateway = charon->kernel_interface->get_nexthop(
+ if (policy->sel.family == AF_INET)
+ {
+ /* get the nexthop to src (src as we are in POLICY_FWD).*/
+ route->gateway = charon->kernel_interface->get_nexthop(
charon->kernel_interface, src);
- route->if_name = charon->kernel_interface->get_interface(
- charon->kernel_interface, dst);
- route->dst_net = chunk_alloc(policy->sel.family == AF_INET ? 4 : 16);
+ /* for IPv4, the route is installed on the outgoing interface */
+ route->if_name = charon->kernel_interface->get_interface(
+ charon->kernel_interface, dst);
+ route->dst_net = chunk_alloc(4);
+ }
+ else
+ {
+ route->gateway = NULL;
+ /* for IPv6, it is on the interface with our source address */
+ route->if_name = charon->kernel_interface->get_interface(
+ charon->kernel_interface, route->src_ip);
+ route->dst_net = chunk_alloc(16);
+ }
memcpy(route->dst_net.ptr, &policy->sel.saddr, route->dst_net.len);
route->prefixlen = policy->sel.prefixlen_s;
memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
- hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP | NLM_F_ROOT;
+ hdr->nlmsg_flags = NLM_F_REQUEST;
+ if (dest->get_family(dest) == AF_INET)
+ {
+ /* We dump all addresses for IPv4, as we want to ignore IPsec specific
+ * routes installed by us. But the kernel does not return source
+ * addresses in a IPv6 dump, so fall back to get() for v6 routes. */
+ hdr->nlmsg_flags |= NLM_F_ROOT | NLM_F_DUMP;
+ }
hdr->nlmsg_type = RTM_GETROUTE;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
netlink_add_attribute(hdr, RTA_DST, dst_net, sizeof(request));
chunk = src_ip->get_address(src_ip);
netlink_add_attribute(hdr, RTA_PREFSRC, chunk, sizeof(request));
- chunk = gateway->get_address(gateway);
- netlink_add_attribute(hdr, RTA_GATEWAY, chunk, sizeof(request));
+ if (gateway && gateway->get_family(gateway) == src_ip->get_family(src_ip))
+ {
+ chunk = gateway->get_address(gateway);
+ netlink_add_attribute(hdr, RTA_GATEWAY, chunk, sizeof(request));
+ }
ifindex = get_interface_index(this, if_name);
chunk.ptr = (char*)&ifindex;
chunk.len = sizeof(ifindex);
* create or delete a rule to use our routing table
*/
static status_t manage_rule(private_kernel_netlink_net_t *this, int nlmsg_type,
- u_int32_t table, u_int32_t prio)
+ int family, u_int32_t table, u_int32_t prio)
{
netlink_buf_t request;
struct nlmsghdr *hdr;
msg = (struct rtmsg*)NLMSG_DATA(hdr);
msg->rtm_table = table;
- msg->rtm_family = AF_INET;
+ msg->rtm_family = family;
msg->rtm_protocol = RTPROT_BOOT;
msg->rtm_scope = RT_SCOPE_UNIVERSE;
msg->rtm_type = RTN_UNICAST;
{
if (this->routing_table)
{
- manage_rule(this, RTM_DELRULE, this->routing_table,
+ manage_rule(this, RTM_DELRULE, AF_INET, this->routing_table,
+ this->routing_table_prio);
+ manage_rule(this, RTM_DELRULE, AF_INET6, this->routing_table,
this->routing_table_prio);
}
if (this->routing_table)
{
- if (manage_rule(this, RTM_NEWRULE, this->routing_table,
+ if (manage_rule(this, RTM_NEWRULE, AF_INET, this->routing_table,
+ this->routing_table_prio) != SUCCESS)
+ {
+ DBG1(DBG_KNL, "unable to create IPv4 routing table rule");
+ }
+ if (manage_rule(this, RTM_NEWRULE, AF_INET6, this->routing_table,
this->routing_table_prio) != SUCCESS)
{
- DBG1(DBG_KNL, "unable to create routing table rule");
+ DBG1(DBG_KNL, "unable to create IPv6 routing table rule");
}
}