denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Only disable DF-flag copying on outbound SAs

Browse Source 
This will cause errors on inbound SAs if the SA direction attribute is
used.
This commit is contained in:
Tobias Brunner
2024-08-07 14:41:28 +02:00
parent dc8fa1b3e8
commit 2601fabbb4
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+4 -5
View File
@@ -1724,11 +1724,6 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
sa->family = id->src->get_family(id->src); sa->family = id->src->get_family(id->src);
sa->mode = mode2kernel(mode); sa->mode = mode2kernel(mode);
if (!data->copy_df)
{
sa->flags |= XFRM_STATE_NOPMTUDISC;
}
if (!data->copy_ecn) if (!data->copy_ecn)
{ {
sa->flags |= XFRM_STATE_NOECN; sa->flags |= XFRM_STATE_NOECN;
@@ -1748,6 +1743,10 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
} }
else else
{ {
if (!data->copy_df)
{
sa->flags |= XFRM_STATE_NOPMTUDISC;
}
switch (data->copy_dscp) switch (data->copy_dscp)
{ {
case DSCP_COPY_IN_ONLY: case DSCP_COPY_IN_ONLY: