denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-rekey: Only rekey installed CHILD_SAs

Browse Source 
Depending on the lifetimes a CHILD_SA we rekeyed as responder might
expire shortly afterwards.  We don't want to rekey it again.

When retrying due to an INVALID_KE_PAYLOAD notify the expected state
is CHILD_REKEYING if it is anything else (e.g. due to a collision) we
ignore it.

We also abort the exchange properly if we don't find the CHILD_SA, no
need for an empty INFORMATIONAL exchange anymore.
This commit is contained in:
Tobias Brunner
2016-06-17 18:48:08 +02:00
parent de4e4687ff
commit 15cea08adc
1 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_rekey.c
+14 -7
View File
@@ -160,14 +160,21 @@ METHOD(task_t, build_i, status_t,
{ /* check if it is an outbound CHILD_SA */ { /* check if it is an outbound CHILD_SA */
this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol, this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, FALSE); this->spi, FALSE);
if (!this->child_sa) if (this->child_sa)
{ /* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA {
* exchange is invalid, we fall back to an INFORMATIONAL exchange.*/ /* we work only with the inbound SPI */
message->set_exchange_type(message, INFORMATIONAL); this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
return SUCCESS;
} }
/* we work only with the inbound SPI */ }
this->spi = this->child_sa->get_spi(this->child_sa, TRUE); if (!this->child_sa ||
(!this->child_create &&
this->child_sa->get_state(this->child_sa) != CHILD_INSTALLED) ||
(this->child_create &&
this->child_sa->get_state(this->child_sa) != CHILD_REKEYING))
{
/* CHILD_SA is gone or in the wrong state, unable to rekey */
message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
return SUCCESS;
} }
config = this->child_sa->get_config(this->child_sa); config = this->child_sa->get_config(this->child_sa);