denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Support anti-replay windows > 2k

Browse Source 
FreeBSD 11.1 supports a new extension to configure larger anti-replay
windows, now configured as number of packets.

Fixes #2461.
This commit is contained in:
Tobias Brunner
2017-11-08 16:35:38 +01:00
parent 21a500a092
commit 88a8fba1c7
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+14 -1
View File
@@ -1740,7 +1740,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
#ifdef __linux__ #ifdef __linux__
sa->sadb_sa_replay = min(data->replay_window, 32); sa->sadb_sa_replay = min(data->replay_window, 32);
#else #else
sa->sadb_sa_replay = (data->replay_window + 7) / 8; sa->sadb_sa_replay = min((data->replay_window + 7) / 8, UINT8_MAX);
#endif #endif
} }
sa->sadb_sa_auth = lookup_algorithm(INTEGRITY_ALGORITHM, data->int_alg); sa->sadb_sa_auth = lookup_algorithm(INTEGRITY_ALGORITHM, data->int_alg);
@@ -1749,6 +1749,19 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
} }
PFKEY_EXT_ADD(msg, sa); PFKEY_EXT_ADD(msg, sa);
#ifdef SADB_X_EXT_SA_REPLAY
if (data->inbound)
{
struct sadb_x_sa_replay *replay;
replay = (struct sadb_x_sa_replay*)PFKEY_EXT_ADD_NEXT(msg);
replay->sadb_x_replay_exttype = SADB_X_EXT_SA_REPLAY;
replay->sadb_x_replay_len = PFKEY_LEN(sizeof(struct sadb_x_sa_replay));
replay->sadb_x_replay_replay = min(data->replay_window, UINT32_MAX-32);
PFKEY_EXT_ADD(msg, replay);
}
#endif
sa2 = (struct sadb_x_sa2*)PFKEY_EXT_ADD_NEXT(msg); sa2 = (struct sadb_x_sa2*)PFKEY_EXT_ADD_NEXT(msg);
sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2; sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
sa2->sadb_x_sa2_len = PFKEY_LEN(sizeof(struct sadb_spirange)); sa2->sadb_x_sa2_len = PFKEY_LEN(sizeof(struct sadb_spirange));