From 4611f41b1e14b9128d2c835a8ae617bd4bd666d1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 5 Jun 2026 08:12:05 +0200 Subject: [PATCH] child-rekey: Only reset state of SAs not actively rekeyed if passive rekeying fails --- src/libcharon/sa/ikev2/tasks/child_rekey.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c index 764c3beb7..6ee98e764 100644 --- a/src/libcharon/sa/ikev2/tasks/child_rekey.c +++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c @@ -403,7 +403,7 @@ METHOD(task_t, build_r, status_t, child_sa_t *child_sa, *old_replacement; child_sa_state_t state = CHILD_INSTALLED; uint32_t reqid; - bool followup_sent = FALSE; + bool active, followup_sent = FALSE; if (!this->child_sa) { @@ -423,7 +423,8 @@ METHOD(task_t, build_r, status_t, message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty); return SUCCESS; } - if (actively_rekeying(this, &followup_sent) && followup_sent) + active = actively_rekeying(this, &followup_sent); + if (active && followup_sent) { DBG1(DBG_IKE, "peer initiated rekeying, but we did too and already " "sent IKE_FOLLOWUP_KE"); @@ -483,8 +484,9 @@ METHOD(task_t, build_r, status_t, /* like installing the outbound SA, we only trigger the child-rekey * event once the old SA is deleted */ } - else if (this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) - { /* rekeying failed, reuse old child */ + else if (!active && + this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) + { /* rekeying failed, reuse old child, unless we are actively rekeying */ this->child_sa->set_state(this->child_sa, state); } return SUCCESS;