From 38a4f1964e98ec9e4e4396c4b3c62855ced6c26a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 19 Nov 2013 12:41:31 +0100 Subject: kernel-netlink: Enable TFC padding only for tunnel mode ESP SAs The kernel does not allow them for transport mode SAs or IPComp SAs (and of course not for AH SAs). Fixes #446. --- src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c') diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c index 8352b9311..128e6571c 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -1459,8 +1459,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t, goto failed; } - if (tfc) - { + if (tfc && protocol == IPPROTO_ESP && mode == MODE_TUNNEL) + { /* the kernel supports TFC padding only for tunnel mode ESP SAs */ u_int32_t *tfcpad; tfcpad = netlink_reserve(hdr, sizeof(request), XFRMA_TFCPAD, -- cgit v1.2.3