denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Instead of rekeying, delete a quick mode if we have a fresher instance

Browse Source 
If both peers initiate quick mode rekeying simultaneously, we end up
with duplicate SAs for a configuration. This can't be avoided, nor do
the standards provide an appropriate solution. Instead of closing one
SA immediately, we keep both. But once rekeying triggers, we don't
refresh the SA with the shorter soft lifetime, but delete it.
This commit is contained in:
Martin Willi
2012-06-08 10:22:03 +02:00
parent 9e9295ed10
commit 1e24fa4614
1 changed files with 42 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/task_manager_v1.c
+42 -6
View File
@@ -1366,6 +1366,34 @@ METHOD(task_manager_t, queue_child, void,
queue_task(this, &task->task);
}
/**
* Check if a CHILD_SA is redundant and we should delete instead of rekey
*/
static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
{
enumerator_t *enumerator;
child_sa_t *current;
bool redundant = FALSE;
enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, &current))
{
if (current->get_state(current) == CHILD_INSTALLED &&
streq(current->get_name(current), child_sa->get_name(child_sa)) &&
current->get_lifetime(current, FALSE) >
child_sa->get_lifetime(child_sa, FALSE))
{
DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
redundant = TRUE;
break;
}
}
enumerator->destroy(enumerator);
return redundant;
}
METHOD(task_manager_t, queue_child_rekey, void,
private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
{
@@ -1380,13 +1408,21 @@ METHOD(task_manager_t, queue_child_rekey, void,
}
if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
{
child_sa->set_state(child_sa, CHILD_REKEYING);
cfg = child_sa->get_config(child_sa);
task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg), NULL, NULL);
task->use_reqid(task, child_sa->get_reqid(child_sa));
task->rekey(task, child_sa->get_spi(child_sa, TRUE));
if (is_redundant(this, child_sa))
{
queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
protocol, spi, FALSE, FALSE));
}
else
{
child_sa->set_state(child_sa, CHILD_REKEYING);
cfg = child_sa->get_config(child_sa);
task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg), NULL, NULL);
task->use_reqid(task, child_sa->get_reqid(child_sa));
task->rekey(task, child_sa->get_spi(child_sa, TRUE));
queue_task(this, &task->task);
queue_task(this, &task->task);
}
}
}