diff options
| author |   Neale Ranns <neale@graphiant.com> | 2022-01-10 11:21:17 +0000 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2022-02-17 15:42:29 +0000 |
| commit | 992a4d0d4e229f9891b0d7b1528fcdb851482385 (patch) | |
| tree | effd7b94f489075320e9567a7941e446a925a529 /src/plugins/urpf | |
| parent | e2b15863f9bcbdb7fddfd9eb62a13b24b8f5b23b (diff) | |
ipsec: Improve the handling of NAT-T keepalive messages
Type: improvement
Ethernet frames on the wire are a minimum of 64 bytes, so use the length in the UDP header to determine if the ESP payload is one bytes of the special SPI, rather than the buffer's size (which will include the ethernet header's padding).
In the case of drop advance the packet back to the IP header so the ipx-drop node sees a sane packet.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Ic3b75487919f0c77507d6f725bd11202bc5afee8
Diffstat (limited to 'src/plugins/urpf')
0 files changed, 0 insertions, 0 deletions