denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

quick-mode: Remove outbound SA/policy of rekeyed CHILD_SA

Browse Source 
Remove outbound SA and policy of rekeyed CHILD_SA since only one is valid.
Otherwise, during update-SA job (when NAT mapping changed), CHILD_SA are
updated and installed one by one, leaving a window where old SAs are being
used. There are also circumstances where the new SA is not processed last.

Closes strongswan/strongswan#1041
This commit is contained in:
Xiao Liang
2022-05-10 09:07:37 +02:00
committed by Tobias Brunner
parent 5cf82de69a
commit 3b742c75ab
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/quick_mode.c
+2
View File
@@ -411,6 +411,8 @@ static bool install(private_quick_mode_t *this)
/* rekeyed CHILD_SAs stay installed until they expire or are deleted /* rekeyed CHILD_SAs stay installed until they expire or are deleted
* by the other peer */ * by the other peer */
old->set_state(old, CHILD_REKEYED); old->set_state(old, CHILD_REKEYED);
/* but remove outbound SA as we don't want to use it actively */
old->remove_outbound(old);
/* as initiator we delete the CHILD_SA if configured to do so */ /* as initiator we delete the CHILD_SA if configured to do so */
if (this->initiator && this->delete) if (this->initiator && this->delete)
{ {