diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2016-06-17 14:56:37 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2016-06-17 18:46:33 +0200 |
| commit | 408282196453b3f610c758d6f96236ac1e9da3c7 (patch) | |
| tree | e0ed539363ce50432c2b141b25581337dab12f6d /src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c | |
| parent | 21aa924233b5e0d53ce454d63e98f92714a2081e (diff) | |
| download | strongswan-408282196453b3f610c758d6f96236ac1e9da3c7.tar.bz2 strongswan-408282196453b3f610c758d6f96236ac1e9da3c7.tar.xz | |
kernel-netlink: Don't set replay window for outbound SAs
It's not necessary and might waste memory. However, if ESN is used we set
the window to 1 as the kernel rejects the attribute otherwise.
Diffstat (limited to 'src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c')
| -rw-r--r-- | src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c index 7e60982f7..9c2a7c315 100644 --- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -1587,6 +1587,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t, if (id->proto != IPPROTO_COMP) { + /* generally, we don't need a replay window for outbound SAs, however, + * when using ESN the kernel rejects the attribute if it is 0 */ + if (!data->inbound && data->replay_window) + { + data->replay_window = data->esn ? 1 : 0; + } if (data->replay_window != 0 && (data->esn || data->replay_window > 32)) { /* for ESN or larger replay windows we need the new |