denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Don't use a default rand_time larger than half of rekey/reauth_time

Browse Source
This commit is contained in:
Martin Willi
2015-03-03 13:49:14 +01:00
parent f6511e36b5
commit 1549a98493
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+11 -3
View File
@@ -1831,9 +1831,17 @@ CALLBACK(config_sn, bool,
} }
if (peer.rand_time == LFT_UNDEFINED) if (peer.rand_time == LFT_UNDEFINED)
{ {
/* default rand_time to over_time if not given */ /* default rand_time to over_time if not given, but don't make it
peer.rand_time = min(peer.over_time, * longer than half of rekey/rauth time */
max(peer.rekey_time, peer.reauth_time) / 2); if (peer.rekey_time && peer.reauth_time)
{
peer.rand_time = min(peer.rekey_time, peer.reauth_time);
}
else
{
peer.rand_time = max(peer.rekey_time, peer.reauth_time);
}
peer.rand_time = min(peer.over_time, peer.rand_time / 2);
} }
log_peer_data(&peer); log_peer_data(&peer);