denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Don't include keys in SADB_UPDATE message to update IPs on FreeBSD

Browse Source 
The FreeBSD kernel explicitly rejects messages containing keys for mature SAs.

Fixes #2457.
This commit is contained in:
Tobias Brunner
2017-11-08 16:34:12 +01:00
parent 441d083cfb
commit 21a500a092
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+3
View File
@@ -1960,6 +1960,8 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
PFKEY_EXT_COPY(msg, response.lft_soft); PFKEY_EXT_COPY(msg, response.lft_soft);
PFKEY_EXT_COPY(msg, response.lft_hard); PFKEY_EXT_COPY(msg, response.lft_hard);
#ifndef __FreeBSD__
/* FreeBSD 11.1 does not allow key updates via SADB_UPDATE for mature SAs */
if (response.key_encr) if (response.key_encr)
{ {
PFKEY_EXT_COPY(msg, response.key_encr); PFKEY_EXT_COPY(msg, response.key_encr);
@@ -1969,6 +1971,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
{ {
PFKEY_EXT_COPY(msg, response.key_auth); PFKEY_EXT_COPY(msg, response.key_auth);
} }
#endif
#ifdef HAVE_NATT #ifdef HAVE_NATT
if (data->new_encap) if (data->new_encap)