[strongSwan] strange traffic selector selecting behavior

[Jaehong Park]

Thank you Tobias.

I figured out the second option you suggested and it resolve my problem.



> On Aug 12, 2019, at 7:19 AM, Tobias Brunner <tobias at strongswan.org> wrote:
> 
> Hi Jaehong,
> 
>> the StrongSwan select wrong selector and program xfrm incorrectly.
> 
> No, everything works as it's designed to.  However, there are several
> aspects that result in the "wrong" outcome in your case.
> 
> It starts with the ping utility that opens a UDP socket to determine
> which local address it should use as source in the ICMP packets.  This
> socket may trigger matching trap policies (auto=route) and the data
> (protocol/ports) of this (unused) UDP connection is received in the
> acquire message from the kernel.  By default, strongSwan prepends that
> received traffic selector to the list of traffic selectors (to allow
> responders to select the most specific traffic selector, which is what
> happens here).
> 
> You can avoid the UDP socket in ping by selecting a specific source IP
> via -I <IP>.  You can also prevent strongSwan from adding the traffic
> selectors from the acquire by enabling charon.ignore_acquire_ts.  You
> could also make the trap policy more specific (e.g. so it doesn't match
> UDP if that's not intended).
> 
> Regards,
> Tobias
>