From 05d54cfa61ef04e334ab3137b05cb4021e4f8515 Mon Sep 17 00:00:00 2001 From: vanhu Date: Wed, 12 Sep 2012 12:14:50 +0000 Subject: In NAT-T transport mode, allow a client to open a new connection just after closing another. It worked only in tunnel mode before. Submitted by: Andreas Longwitz MFC after: 1M --- sys/netipsec/key.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'sys/netipsec') diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index 0e8e493..bda5d41 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -4055,10 +4055,12 @@ key_cmpsaidx( /* * If NAT-T is enabled, check ports for tunnel mode. * Do not check ports if they are set to zero in the SPD. - * Also do not do it for transport mode, as there is no - * port information available in the SP. + * Also do not do it for native transport mode, as there + * is no port information available in the SP. */ - if (saidx1->mode == IPSEC_MODE_TUNNEL && + if ((saidx1->mode == IPSEC_MODE_TUNNEL || + (saidx1->mode == IPSEC_MODE_TRANSPORT && + saidx1->proto == IPPROTO_ESP)) && saidx1->src.sa.sa_family == AF_INET && saidx1->dst.sa.sa_family == AF_INET && ((const struct sockaddr_in *)(&saidx1->src))->sin_port && -- cgit v1.1