svn commit: r240392 - head/sys/netipsec
VANHULLEBUS Yvan
vanhu at FreeBSD.org
Wed Sep 12 12:14:50 UTC 2012
Author: vanhu
Date: Wed Sep 12 12:14:50 2012
New Revision: 240392
URL: http://svn.freebsd.org/changeset/base/240392
Log:
In NAT-T transport mode, allow a client to open a new connection just after
closing another.
It worked only in tunnel mode before.
Submitted by: Andreas Longwitz <longwitz at incore.de>
MFC after: 1M
Modified:
head/sys/netipsec/key.c
Modified: head/sys/netipsec/key.c
==============================================================================
--- head/sys/netipsec/key.c Wed Sep 12 11:41:03 2012 (r240391)
+++ head/sys/netipsec/key.c Wed Sep 12 12:14:50 2012 (r240392)
@@ -4055,10 +4055,12 @@ key_cmpsaidx(
/*
* If NAT-T is enabled, check ports for tunnel mode.
* Do not check ports if they are set to zero in the SPD.
- * Also do not do it for transport mode, as there is no
- * port information available in the SP.
+ * Also do not do it for native transport mode, as there
+ * is no port information available in the SP.
*/
- if (saidx1->mode == IPSEC_MODE_TUNNEL &&
+ if ((saidx1->mode == IPSEC_MODE_TUNNEL ||
+ (saidx1->mode == IPSEC_MODE_TRANSPORT &&
+ saidx1->proto == IPPROTO_ESP)) &&
saidx1->src.sa.sa_family == AF_INET &&
saidx1->dst.sa.sa_family == AF_INET &&
((const struct sockaddr_in *)(&saidx1->src))->sin_port &&
More information about the svn-src-head
mailing list