denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Allow immediate deletion of rekeyed CHILD_SAs

Browse Source 
When charon rekeys a CHILD_SA after a soft limit expired, it is only
deleted after the hard limit is reached.  In case of packet/byte limits
this may not be the case for a long time since the packets/bytes are
usually sent using the new SA.  This may result in a very large number of
stale CHILD_SAs and kernel states.  With enough connections configured this
will ultimately exhaust the memory of the system.

This patch adds a strongswan.conf setting that, if enabled, causes the old
CHILD_SA to be deleted by the initiator after a successful rekeying.

Enabling this setting might create problems with implementations that
continue to use rekeyed SAs (e.g. if the DELETE notify is lost).
This commit is contained in:
Tobias Brunner
2016-03-03 17:28:03 +01:00
parent 904f93f655
commit 2f3c08d268
2 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+8
View File
@@ -61,6 +61,14 @@ charon.crypto_test.required = no
charon.crypto_test.rng_true = no
Whether to test RNG with TRUE quality; requires a lot of entropy.
charon.delete_rekeyed = no
Delete CHILD_SAs right after they got successfully rekeyed (IKEv1 only).
Delete CHILD_SAs right after they got successfully rekeyed (IKEv1 only).
Reduces the number of stale CHILD_SAs in scenarios with a lot of rekeyings.
However, this might cause problems with implementations that continue to
use rekeyed SAs until they expire.
charon.dh_exponent_ansi_x9_42 = yes
Use ANSI X9.42 DH exponent size or optimum size matched to cryptographic
strength.