denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Enable mixed-family IPComp scenarios

Browse Source 
Since 6.3, the kernel allows setting XFRM_STATE_AF_UNSPEC for transport
mode SAs, which allows mixed-family use of IPComp.
This commit is contained in:
Tobias Brunner
2026-06-04 11:22:58 +02:00
parent 531de4d858
commit a904f9125d
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+13 -1
View File
@@ -370,6 +370,11 @@ struct private_kernel_netlink_ipsec_t {
*/ */
bool sa_lastused; bool sa_lastused;
/**
* Whether the kernel accepts XFRM_STATE_AF_UNSPEC for transport mode
*/
bool sa_unspec_transport;
/** /**
* Whether the kernel supports setting the SA direction * Whether the kernel supports setting the SA direction
*/ */
@@ -1861,6 +1866,10 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
if (original_mode == MODE_TUNNEL) if (original_mode == MODE_TUNNEL)
{ /* don't install selectors for switched SAs. because only one { /* don't install selectors for switched SAs. because only one
* selector can be installed other traffic would get dropped */ * selector can be installed other traffic would get dropped */
if (this->sa_unspec_transport)
{
sa->flags |= XFRM_STATE_AF_UNSPEC;
}
break; break;
} }
if (data->src_ts->get_first(data->src_ts, if (data->src_ts->get_first(data->src_ts,
@@ -4311,9 +4320,12 @@ static void check_kernel_features(private_kernel_netlink_ipsec_t *this)
{ {
case 2: case 2:
case 3: case 3:
/* before 6.2 the kernel only provided the last used time for /* before 6.2, the kernel only provided the last used time for
* specific outbound IPv6 SAs */ * specific outbound IPv6 SAs */
this->sa_lastused = a > 6 || (a == 6 && b >= 2); this->sa_lastused = a > 6 || (a == 6 && b >= 2);
/* before 6.3, the kernel rejected XFRM_STATE_AF_UNSPEC on
* transport mode SAs */
this->sa_unspec_transport = a > 6 || (a == 6 && b >= 3);
/* 6.10 added support for SA direction and enforces certain /* 6.10 added support for SA direction and enforces certain
* flags e.g. 0 replay window for outbound SAs */ * flags e.g. 0 replay window for outbound SAs */
this->sa_dir = a > 6 || (a == 6 && b >= 10); this->sa_dir = a > 6 || (a == 6 && b >= 10);