diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2016-06-17 14:52:11 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2016-06-17 18:46:33 +0200 |
| commit | 21aa924233b5e0d53ce454d63e98f92714a2081e (patch) | |
| tree | 1f7d0cba877514532446a242f0cbab0ce17218a2 /src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c | |
| parent | c423d0e8a124044650842ddb66d88f40f79585d4 (diff) | |
| download | strongswan-21aa924233b5e0d53ce454d63e98f92714a2081e.tar.bz2 strongswan-21aa924233b5e0d53ce454d63e98f92714a2081e.tar.xz | |
kernel-pfkey: Only set the replay window for inbound SAs
It is not necessary for outbound SAs and might waste memory when large
window sizes are used.
Diffstat (limited to 'src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c')
| -rw-r--r-- | src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c index 516a15abe..1b22ea549 100644 --- a/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c +++ b/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c @@ -1725,12 +1725,17 @@ METHOD(kernel_ipsec_t, add_sa, status_t, else { /* Linux interprets sadb_sa_replay as number of packets/bits in the - * replay window, whereas on BSD it's the size of the window in bytes */ + * replay window, whereas on BSD it's the size of the window in bytes. + * Only set for the inbound SA as it's not relevant for the outbound + * SA and might waste memory with large windows. */ + if (data->inbound) + { #ifdef __linux__ - sa->sadb_sa_replay = min(data->replay_window, 32); + sa->sadb_sa_replay = min(data->replay_window, 32); #else - sa->sadb_sa_replay = (data->replay_window + 7) / 8; + sa->sadb_sa_replay = (data->replay_window + 7) / 8; #endif + } sa->sadb_sa_auth = lookup_algorithm(INTEGRITY_ALGORITHM, data->int_alg); sa->sadb_sa_encrypt = lookup_algorithm(ENCRYPTION_ALGORITHM, data->enc_alg); |