sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-03 00:00:24 -04:00
Code Issues Projects Releases Wiki Activity

conf: Document global IP-TFS settings

Browse Source
This commit is contained in:
Tobias Brunner 2025-05-15 12:58:12 +02:00
parent 46525cdc4f
commit a7a3c4a22a
3 changed files with 40 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
conf/Makefile.am
View File

@ -16,6 +16,7 @@ options = \
options/charon-systemd.opt \
options/imcv.opt \
options/imv_policy_manager.opt \
options/iptfs.opt \
options/manager.opt \
options/medsrv.opt \
options/pki.opt \

38
conf/options/iptfs.opt Normal file
View File

@ -0,0 +1,38 @@
charon.iptfs {}
Global settings for IP-TFS (RFC 9347). The Linux kernel supports this mode
since 6.14. However, it currently only supports aggregation/fragmentation of
tunneled IP packets in ESP/AGGFRAG packets. It doesn't yet support other
IP-TFS features like sending packets at a constant rate or congestion control.
charon.iptfs.drop_time = 1000000
Time in microseconds to wait for out-of-order packets when processing
inbound traffic.
charon.iptfs.reorder_window = 3
Number of packets that may arrive out of order when processing inbound
traffic.
charon.iptfs.init_delay = 0
Time in microseconds to wait for subsequent packets to aggregate together
when sending outbound traffic. Only relevant if no packets are already
queued to be sent.
charon.iptfs.max_queue_size = 1048576
Maximum number of bytes allowed to be queued for sending on the tunnel
(default 1 MiB). If the queue is full, packets are dropped.
charon.iptfs.packet_size = 0
Maximum outer packet size (layer 3) when sending packets. The default of 0
will use the PMTU as packet size. Note that the kernel currently doesn't
pad smaller packets.
charon.iptfs.accept_fragments = yes
Whether fragments of inner packets across multiple AGGFRAG payloads are
accepted. This is an IKEv2 option, so if the peer doesn't adhere to this
request and still sends such fragments, they will be processed by the
kernel.
charon.iptfs.dont_frag = no
Force disabling fragmenting inner packets across multiple AGGFRAG payloads
when sending outbound traffic (fragmentation is automatically disabled if
the peer indicates that it doesn't support handling such packets).

2
configure.ac
View File

@ -1949,7 +1949,7 @@ strongswan_options=
AM_COND_IF([USE_AIKGEN], [strongswan_options=${strongswan_options}" aikgen"])
AM_COND_IF([USE_ATTR_SQL], [strongswan_options=${strongswan_options}" pool"])
AM_COND_IF([USE_CHARON], [strongswan_options=${strongswan_options}" charon charon-logging"])
AM_COND_IF([USE_CHARON], [strongswan_options=${strongswan_options}" charon charon-logging iptfs"])
AM_COND_IF([USE_FILE_CONFIG], [strongswan_options=${strongswan_options}" starter"])
AM_COND_IF([USE_IMV_ATTESTATION], [strongswan_options=${strongswan_options}" attest"])
AM_COND_IF([USE_IMCV], [strongswan_options=${strongswan_options}" imcv imv_policy_manager"])