diff options
| author | Benedict Wong <benedictwong@google.com> | 2021-04-20 00:07:13 -0700 |
|---|---|---|
| committer | Benedict Wong <benedictwong@google.com> | 2021-04-27 19:03:41 +0000 |
| commit | 73119c28bb6c334c728536e0ff51ff988a8f08da (patch) | |
| tree | 37dbbe5de57a67f97c66c521fa0a33bba2e9b155 /server/NetworkController.cpp | |
| parent | 10f625b99c502e9daea073b712a39d3827404c4e (diff) | |
Reset firewall mark after IPsec decryption
This change ensures that the firewall marks post-decryption are reset,
due to routing rules not handling decapsulated packets properly.
At present, forwarding rules (and a few others) expect the inbound
network to be clear, and not have a network explicitly selected.
However, because IPsec traffic routes through the filter_INPUT chain
before being decrypted, the input interface is stamped onto it for
packet mirroring purposes (ICMP/TCP acks, etc), and no longer matches
the relevant rules for forwarding decapsulated IPsec packets.
Bug: 185495453
Test: atest FrameworksVcnTests
Test: atest CtsNetTestCases:IpSecManagerTunnelTest
Test: atest CtsNetTestCases:IpSecManagerTest
Test: atest Ikev2VpnTest
Test: atest CtsIkeTestCases
Change-Id: Ib47d53c3e53295667a8d4645b8937eb834278026
Diffstat (limited to 'server/NetworkController.cpp')
0 files changed, 0 insertions, 0 deletions