ike: Set default IKE fragment size to 1280

This is the minimum size an IPv6 implementation must support.  This makes
it the default for IPv4 too, which presumably is also generally routable
(otherwise, setting this to 0 falls back to the minimum of 576 for IPv4).

diff --git a/conf/options/charon.opt b/conf/options/charon.opt
index 3970012d2a807994d79037dd59d005c423073002..04e099e12c496310c95d0db9faff57da521b00bb 100644 (file)
--- a/conf/options/charon.opt
+++ b/conf/options/charon.opt
@@ -100,11 +100,12 @@ charon.flush_auth_cfg = no
 charon.follow_redirects = yes
        Whether to follow IKEv2 redirects (RFC 5685).
 
-charon.fragment_size = 0
+charon.fragment_size = 1280
        Maximum size (complete IP datagram size in bytes) of a sent IKE fragment
-       when using proprietary IKEv1 or standardized IKEv2 fragmentation (0 for
-       address family specific default values). If specified this limit is used
-       for both IPv4 and IPv6.
+       when using proprietary IKEv1 or standardized IKEv2 fragmentation, defaults
+       to 1280 (use 0 for address family specific default values, which uses a
+       lower value for IPv4).  If specified this limit is used for both IPv4 and
+       IPv6.
 
 charon.group
        Name of the group the daemon changes to after startup.

diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
index 239e260b1e95442d9af953101ff59010235ce165..ceeafcbb845b59bda020fa5fdaff6a18d3fa3703 100644 (file)
--- a/src/libcharon/sa/ike_sa.c
+++ b/src/libcharon/sa/ike_sa.c
@@ -2979,7 +2979,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator,
                .flush_auth_cfg = lib->settings->get_bool(lib->settings,
                                                                "%s.flush_auth_cfg", FALSE, lib->ns),
                .fragment_size = lib->settings->get_int(lib->settings,
-                                                               "%s.fragment_size", 0, lib->ns),
+                                                               "%s.fragment_size", 1280, lib->ns),
                .follow_redirects = lib->settings->get_bool(lib->settings,
                                                                "%s.follow_redirects", TRUE, lib->ns),
        );