denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an option to announce support for IKE fragmentation but not sending fragments

Browse Source
This commit is contained in:
Tobias Brunner
2017-05-23 16:41:57 +02:00
parent cbbd34f507
commit 46a3f92a76
6 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+11 -7
View File
@@ -154,15 +154,19 @@ connections.<conn>.dpd_timeout = 0s
specified; this option has no effect on connections using IKE2.
connections.<conn>.fragmentation = yes
Use IKE UDP datagram fragmentation. (_yes_, _no_ or _force_).
Use IKE UDP datagram fragmentation. (_yes_, _accept_, _no_ or _force_).
Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
fragmentation). Acceptable values are _yes_ (the default), _force_ and
_no_. Fragmented IKE messages sent by a peer are always accepted
irrespective of the value of this option. If set to _yes_, and the peer
supports it, oversized IKE messages will be sent in fragments. If set to
_force_ (only supported for IKEv1) the initial IKE message will already
be fragmented if required.
fragmentation). Acceptable values are _yes_ (the default), _accept_,
_force_ and _no_. If set to _yes_, and the peer supports it, oversized IKE
messages will be sent in fragments. If set to _accept_, support for
fragmentation is announced to the peer but the daemon does not send its own
messages in fragments. If set to _force_ (only supported for IKEv1) the
initial IKE message will already be fragmented if required. Finally, setting
the option to _no_ will disable announcing support for this feature.
Note that fragmented IKE messages sent by a peer are always accepted
irrespective of the value of this option (even when set to _no_).
connections.<conn>.send_certreq = yes
Send certificate requests payloads (_yes_ or _no_).