denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-rekey: Respond with TEMPORARY_FAILURE while reauthenticating

Browse Source 
This could lead to duplicates as the new IKE_SA can't delete the old one
once reauthentication is complete if it was replaced by a rekeying.
This commit is contained in:
Tobias Brunner
2021-08-24 14:31:55 +02:00
parent 36161febd3
commit 0d373e25e0
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_rekey.c
+6
View File
@@ -231,6 +231,12 @@ METHOD(task_t, process_r, status_t,
this->failed_temporarily = TRUE; this->failed_temporarily = TRUE;
return NEED_MORE; return NEED_MORE;
} }
if (this->ike_sa->has_condition(this->ike_sa, COND_REAUTHENTICATING))
{
DBG1(DBG_IKE, "peer initiated rekeying, but we are reauthenticating");
this->failed_temporarily = TRUE;
return NEED_MORE;
}
if (have_half_open_children(this)) if (have_half_open_children(this))
{ {
DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open"); DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");