denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Always enable charon.reuse_ikesa

Browse Source 
With IKEv1 we have to reuse IKE_SAs as otherwise the responder might
detect the new SA as reauthentication and will "adopt" the CHILD_SAs of
the original IKE_SA, while the initiator will not do so.  This could
cause CHILD_SA rekeying to fail later.

Fixes #1236.
This commit is contained in:
Tobias Brunner
2016-02-01 11:37:41 +01:00
parent db57f5702b
commit 24ab8530e5
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+1 -1
View File
@@ -283,7 +283,7 @@ charon.retry_initiate_interval = 0
resolution failed), 0 to disable retries. resolution failed), 0 to disable retries.
charon.reuse_ikesa = yes charon.reuse_ikesa = yes
Initiate CHILD_SA within existing IKE_SAs. Initiate CHILD_SA within existing IKE_SAs (always enabled for IKEv1).
charon.routing_table charon.routing_table
Numerical routing table to install routes to. Numerical routing table to install routes to.
src/libcharon/sa/ike_sa_manager.c
+2 -2
View File
@@ -1384,8 +1384,8 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
DBG2(DBG_MGR, "checkout IKE_SA by config"); DBG2(DBG_MGR, "checkout IKE_SA by config");
if (!this->reuse_ikesa) if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
{ /* IKE_SA reuse disable by config */ { /* IKE_SA reuse disabled by config (not possible for IKEv1) */
ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
charon->bus->set_sa(charon->bus, ike_sa); charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa; return ike_sa;