diff options
| author | Miloslav Trmac <mitr@volny.cz> | 2006-07-08 01:29:42 +0000 |
|---|---|---|
| committer | Miloslav Trmac <mitr@volny.cz> | 2006-07-08 01:29:42 +0000 |
| commit | 59246de763ead6ad4f7b8c7d8b2bb847e45f7865 (patch) | |
| tree | e048a2f0ad82c04ad1e2374cfb5c5fc2f2d19669 /sysconfig/network-scripts/ifdown-ipsec | |
| parent | 76afb000ffb6eaeb9bcc07f005dc0d29ee928b8b (diff) | |
| download | initscripts-59246de763ead6ad4f7b8c7d8b2bb847e45f7865.tar initscripts-59246de763ead6ad4f7b8c7d8b2bb847e45f7865.tar.gz initscripts-59246de763ead6ad4f7b8c7d8b2bb847e45f7865.tar.bz2 initscripts-59246de763ead6ad4f7b8c7d8b2bb847e45f7865.tar.xz initscripts-59246de763ead6ad4f7b8c7d8b2bb847e45f7865.zip | |
Prevent IPsec tunelling of local traffic when tunnel subnets overlap (#150862)
Diffstat (limited to 'sysconfig/network-scripts/ifdown-ipsec')
| -rwxr-xr-x | sysconfig/network-scripts/ifdown-ipsec | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/sysconfig/network-scripts/ifdown-ipsec b/sysconfig/network-scripts/ifdown-ipsec index 722c12df..3b03e277 100755 --- a/sysconfig/network-scripts/ifdown-ipsec +++ b/sysconfig/network-scripts/ifdown-ipsec @@ -37,6 +37,14 @@ fi if [ -n "$SRCNET" -o -n "$DSTNET" ]; then MODE=tunnel + [ -z "$SRCNET" ] && SRCNET="$SRC/32" + [ -z "$DSTNET" ] && DSTNET="$DST/32" + # If SRCNET is a subnet of DSTNET, exclude SRCNET<->SRCNET communication + if [ "${SRCNET##*/}" -gt "${DSTNET##*/}" ] \ + && [ "$(ipcalc -n "${SRCNET%%/*}/${DSTNET##*/}")" \ + = "NETWORK=${DSTNET%%/*}" ]; then + EXCLUDE_SRCNET=yes + fi else MODE=host fi @@ -60,15 +68,14 @@ if [ "$MODE" = "host" ]; then spddelete $DST $SRC any -P in; EOF else - [ -z "$SRCNET" ] && SRCNET="$SRC/32" - [ -z "$DSTNET" ] && DSTNET="$DST/32" - [ -z "$SRCGW" ] && SRCGW=`ip -o route get to $SRCNET | sed "s|.*src \([^ ]*\).*|\1|"` ip route del to $DSTNET via $SRCGW src $SRCGW /sbin/setkey -c >/dev/null 2>&1 << EOF spddelete $SRCNET $DSTNET any -P out; spddelete $DSTNET $SRCNET any -P in; + ${EXCLUDE_SRCNET:+spddelete $SRCNET $SRCNET any -P out;} + ${EXCLUDE_SRCNET:+spddelete $SRCNET $SRCNET any -P in;} EOF fi |