From 10f8834bf927f3cf880359995c8a11bac7fc45c9 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 5 Dec 2018 12:24:55 +0100 Subject: [PATCH] ikev2: Don't recreate IKE_SA if deletion fails after make-before-break reauth Fixes: 745714307256 ("During reauthentication reestablish IKE_SA even if deleting the old one fails.") Fixes #2847. --- src/libcharon/sa/ike_sa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index a4ad866d3..27b0c337f 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -2404,7 +2404,9 @@ METHOD(ike_sa_t, retransmit, status_t, } case IKE_DELETING: DBG1(DBG_IKE, "proper IKE_SA delete failed, peer not responding"); - if (has_condition(this, COND_REAUTHENTICATING)) + if (has_condition(this, COND_REAUTHENTICATING) && + !lib->settings->get_bool(lib->settings, + "%s.make_before_break", FALSE, lib->ns)) { DBG1(DBG_IKE, "delete during reauthentication failed, " "trying to reestablish IKE_SA anyway");