From 4cb21c8e5d70d20df94f5d892471a11488547881 Mon Sep 17 00:00:00 2001 From: Filip Tehlar Date: Sat, 6 Jun 2020 01:19:31 +0000 Subject: ikev2: don't add DH group in ESP transform proposals Type: fix Anouncing DH group in esp transform proposals will enable PFS which is not suppored now. This fixes issue during rekey when using strongswan as responder. Change-Id: Ib9f586113ae0ab9dc67e6ceadff43f8aac463820 Signed-off-by: Filip Tehlar --- src/plugins/ikev2/ikev2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/plugins/ikev2/ikev2.c') diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c index bba8876c046..211cf25ef43 100644 --- a/src/plugins/ikev2/ikev2.c +++ b/src/plugins/ikev2/ikev2.c @@ -3011,7 +3011,7 @@ ikev2_set_initiator_proposals (vlib_main_t * vm, ikev2_sa_t * sa, } /* DH */ - if (is_ike || ts->dh_type != IKEV2_TRANSFORM_DH_TYPE_NONE) + if (is_ike) { error = 1; vec_foreach (td, km->supported_transforms) -- cgit 1.2.3-korg