denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Only delete redundant CHILD_SAs if configured

Browse Source 
If we find a redundant CHILD_SA (the peer probably rekeyed the SA before
us) we might not want to delete the old SA because the peer might still
use it (same applies to old CHILD_SAs after rekeyings).  So only delete
them if configured to do so.

Fixes #2358.
This commit is contained in:
Tobias Brunner
2017-06-26 10:33:16 +02:00
parent 56ffcdb166
commit 083208e805
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/task_manager_v1.c
+4
View File
@@ -1805,9 +1805,13 @@ METHOD(task_manager_t, queue_child_rekey, void,
if (is_redundant(this, child_sa)) if (is_redundant(this, child_sa))
{ {
child_sa->set_state(child_sa, CHILD_REKEYED); child_sa->set_state(child_sa, CHILD_REKEYED);
if (lib->settings->get_bool(lib->settings, "%s.delete_rekeyed",
FALSE, lib->ns))
{
queue_task(this, (task_t*)quick_delete_create(this->ike_sa, queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
protocol, spi, FALSE, FALSE)); protocol, spi, FALSE, FALSE));
} }
}
else else
{ {
child_sa->set_state(child_sa, CHILD_REKEYING); child_sa->set_state(child_sa, CHILD_REKEYING);