kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windows

Trying to disable replay windows using the ESN attribute fails with EINVAL.
Use non-ESN legacy format to disable replay windows, even if ESN has been
negotiated over IKE.

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
index c015c0f3219d12f33918d0cbb50b4f0f09f57cc0..1e250d00488a74ea49bb29cf9a9519bb1ad619b6 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -1460,7 +1460,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
 
        if (protocol != IPPROTO_COMP)
        {
-               if (esn || replay_window > 32)
+               if (replay_window != 0 && (esn || replay_window > 32))
                {
                        /* for ESN or larger replay windows we need the new
                         * XFRMA_REPLAY_ESN_VAL attribute to configure a bitmap */