diff options
| author | Gert Doering <gert@greenie.muc.de> | 2015-09-11 17:33:43 +0200 |
|---|---|---|
| committer | Gert Doering <gert@greenie.muc.de> | 2015-09-17 19:47:07 +0200 |
| commit | 3ddb56433b1fa0f20565dfda13a647459c06251a (patch) | |
| tree | c8cfed4b08eb09077448e643ad666478f5f9c49e /src/openvpn/ssl.c | |
| parent | 3128abcfdd1eb293b10e4d0bfdb0805728538563 (diff) | |
| download | openvpn-3ddb56433b1fa0f20565dfda13a647459c06251a.tar.gz openvpn-3ddb56433b1fa0f20565dfda13a647459c06251a.tar.xz openvpn-3ddb56433b1fa0f20565dfda13a647459c06251a.zip | |
Implement handling of overlapping IPv6 routes with IPv6 remote VPN server address
- socket.[ch]: add link_socket_current_remote_ipv6() helper to extract
current address of remote VPN server (if IPv6, NULL otherwise), IPv6
equivalent to link_socket_current_remote()
- init.c: pass remote VPN server address to init_route_ipv6_list()
(link_socket_current_remote_ipv6())
- route.h: add route_ipv6_gateway_info to route_ipv6_list, and reorder
structures so that this actually compiles. Add iface/adapter_index
to struct route_ipv6 (for non-tun/tap routes).
- route.[ch]: add "const" to *dest argument to get_default_gateway_ipv6()
- route.c: add route_ipv6_match_host() helper to check whether an IPv6
address is matched by a given "route_ipv6" IPv6 route)
- route.c: init_route_ipv6_list()
- call get_default_gateway_ipv6()
- check to-be-installed IPv6 routes against VPN server address (if IPv6)
- if an overlap is seen, add a host route for the VPN server address
via the just-discovered gateway to the list of IPv6 routes to be
installed (rl6->routes_ipv6)
- warn if overlap is detected but platform code has not been able to
discover IPv6 default gateway
- route.c: add_route_ipv6() / delete_route_ipv6(): set "device" to
"external default gateway interface" (r6->iface) instead of TUN/TAP
device (if set), which nicely enables arbitrary gateway/interface
combinations for Linux
- ssl.c: add "IV_RGI6=1" to push-peer-info data to let server know we can
handle pushed IPv6 routes that overlap with server IPv6 address
- tun.c: when adding/removing on-link routes, CLEAR(r6) first to
ensure new struct route_ipv6 members are cleared
Tested on Linux with iproute2 and /bin/route, on eth and tun routes.
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1441985627-14822-7-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10089
Diffstat (limited to 'src/openvpn/ssl.c')
| -rw-r--r-- | src/openvpn/ssl.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 4e44410..54a3e09 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -1853,6 +1853,9 @@ push_peer_info(struct buffer *buf, struct tls_session *session) comp_generate_peer_info_string(&session->opt->comp_options, &out); #endif + /* support for redirecting IPv6 gateway */ + buf_printf(&out, "IV_RGI6=1\n"); + if (session->opt->push_peer_info_detail >= 2) { /* push mac addr */ |