ipsec-types: Support the %unique mark value

diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in
index f84e331..851bd17 100644 (file)
--- a/man/ipsec.conf.5.in
+++ b/man/ipsec.conf.5.in
@@ -987,7 +987,9 @@ sets an XFRM mark in the inbound and outbound
 IPsec SAs and policies. If the mask is missing then a default
 mask of
 .B 0xffffffff
-is assumed.
+is assumed. The special value
+.B %unique
+assigns a unique value to each newly created IPsec SA.
 .TP
 .BR mark_in " = <value>[/<mask>]"
 sets an XFRM mark in the inbound IPsec SA and

diff --git a/src/libstrongswan/ipsec/ipsec_types.c b/src/libstrongswan/ipsec/ipsec_types.c
index 4bbd918..f2ee11e 100644 (file)
--- a/src/libstrongswan/ipsec/ipsec_types.c
+++ b/src/libstrongswan/ipsec/ipsec_types.c
@@ -48,7 +48,15 @@ bool mark_from_string(const char *value, mark_t *mark)
        {
                return FALSE;
        }
-       mark->value = strtoul(value, &endptr, 0);
+       if (strcasepfx(value, "%unique"))
+       {
+               mark->value = MARK_UNIQUE;
+               endptr = (char*)value + strlen("%unique");
+       }
+       else
+       {
+               mark->value = strtoul(value, &endptr, 0);
+       }
        if (*endptr)
        {
                if (*endptr != '/')

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 5880045..01ff48e 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -622,9 +622,10 @@ connections.<conn>.children.<child>.reqid = 0
 connections.<conn>.children.<child>.mark_in = 0/0x00000000
        Netfilter mark and mask for input traffic.
 
-       Netfilter mark and mask for input traffic. On Linux Netfilter may apply
-       marks to each packet coming from a tunnel having that option set. The
-       mark may then be used by Netfilter to match rules.
+       Netfilter mark and mask for input traffic. On Linux Netfilter may require
+       marks on each packet to match an SA having that option set. This allows
+       Netfilter rules to select specific tunnels for incoming traffic. The
+       special value _%unique_ sets a unique mark on each CHILD_SA instance.
 
        An additional mask may be appended to the mark, separated by _/_. The
        default mask if omitted is 0xffffffff.
@@ -634,7 +635,8 @@ connections.<conn>.children.<child>.mark_out = 0/0x00000000
 
        Netfilter mark and mask for output traffic. On Linux Netfilter may require
        marks on each packet to match a policy having that option set. This allows
-       Netfilter rules to select specific tunnels for outgoing traffic.
+       Netfilter rules to select specific tunnels for outgoing traffic. The
+       special value _%unique_ sets a unique mark on each CHILD_SA instance.
 
        An additional mask may be appended to the mark, separated by _/_. The
        default mask if omitted is 0xffffffff.