diff options
| author | Martin Willi <martin@revosec.ch> | 2014-06-18 14:57:21 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-06-18 15:04:57 +0200 |
| commit | 8b9b11919d92e9738bb52901c9dbcc72e35b9fed (patch) | |
| tree | a4d9f5c4199c37426bddeceefbd37dfcc2d80a47 /src | |
| parent | d345f0b75d3f341c21223de4e4f7380303f3fa28 (diff) | |
| download | strongswan-8b9b11919d92e9738bb52901c9dbcc72e35b9fed.tar.bz2 strongswan-8b9b11919d92e9738bb52901c9dbcc72e35b9fed.tar.xz | |
kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windows
Trying to disable replay windows using the ESN attribute fails with EINVAL.
Use non-ESN legacy format to disable replay windows, even if ESN has been
negotiated over IKE.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c index c015c0f32..1e250d004 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -1460,7 +1460,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t, if (protocol != IPPROTO_COMP) { - if (esn || replay_window > 32) + if (replay_window != 0 && (esn || replay_window > 32)) { /* for ESN or larger replay windows we need the new * XFRMA_REPLAY_ESN_VAL attribute to configure a bitmap */ |