diff options
| author | Martin Willi <martin@strongswan.org> | 2017-02-22 10:01:19 +0100 |
|---|---|---|
| committer | Martin Willi <martin@strongswan.org> | 2017-03-02 08:24:02 +0100 |
| commit | d536b94e0d12543e548ed4f0df2220384293f08e (patch) | |
| tree | e738bf30202cd9619e068e735b21528b58e91903 /src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c | |
| parent | d1317adb9a45166cdc8f44117a5fa85ecd053552 (diff) | |
| download | strongswan-d536b94e0d12543e548ed4f0df2220384293f08e.tar.bz2 strongswan-d536b94e0d12543e548ed4f0df2220384293f08e.tar.xz | |
addrblock: Use dynamic TS narrowing instead of rejecting the whole CHILD_SA
Previously, the client had to propose no wider selectors than the certificate
permits, otherwise the complete CHILD_SA was rejected. However, with IKEv2
we can dynamically narrow the selectors to what the certificate allows. This
makes client and gateway configurations very simple by just proposing 0.0.0.0/0,
narrowed to selectors the client is permitted to route into the network.
Diffstat (limited to 'src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c')
0 files changed, 0 insertions, 0 deletions