denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'ikev1-rekey-deletion'

Browse Source 
Sends a DELETE when rekeyed IKE_SAs are deleted. This fixes issues with
peers (e.g. Cisco) that continue to send DPDs on the old SA and then
delete all SAs if no response is received.  But since the DELETE could get
dropped this might not fix the issue in all cases.

Also, when terminating an IKE_SA DELETES for all CHILD_SAs are now sent
before sending one for the IKE_SA and destroying it.

Fixes #2090.
This commit is contained in:
Tobias Brunner
2016-10-04 10:25:01 +02:00
parent 9691e537cd b56b850251
commit 3713d3024f
2 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+5 -9
View File
@@ -1781,16 +1781,12 @@ METHOD(ike_sa_t, delete_, status_t,
{
switch (this->state)
{
case IKE_REKEYING:
if (this->version == IKEV1)
{ /* SA has been reauthenticated, delete */
charon->bus->ike_updown(charon->bus, &this->public, FALSE);
break;
}
/* FALL */
case IKE_ESTABLISHED:
if (time_monotonic(NULL) >= this->stats[STAT_DELETE])
{ /* IKE_SA hard lifetime hit */
case IKE_REKEYING:
if (time_monotonic(NULL) >= this->stats[STAT_DELETE] &&
!(this->version == IKEV1 && this->state == IKE_REKEYING))
{ /* IKE_SA hard lifetime hit, ignored for reauthenticated
* IKEv1 SAs */
charon->bus->alert(charon->bus, ALERT_IKE_SA_EXPIRED);
}
this->task_manager->queue_ike_delete(this->task_manager);
src/libcharon/sa/ikev1/task_manager_v1.c
+10 -2
View File
@@ -515,13 +515,13 @@ METHOD(task_manager_t, initiate, status_t,
new_mid = TRUE;
break;
}
if (activate_task(this, TASK_ISAKMP_DELETE))
if (activate_task(this, TASK_QUICK_DELETE))
{
exchange = INFORMATIONAL_V1;
new_mid = TRUE;
break;
}
if (activate_task(this, TASK_QUICK_DELETE))
if (activate_task(this, TASK_ISAKMP_DELETE))
{
exchange = INFORMATIONAL_V1;
new_mid = TRUE;
@@ -547,6 +547,14 @@ METHOD(task_manager_t, initiate, status_t,
break;
}
break;
case IKE_REKEYING:
if (activate_task(this, TASK_ISAKMP_DELETE))
{
exchange = INFORMATIONAL_V1;
new_mid = TRUE;
break;
}
break;
default:
break;
}