denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Trigger ike_updown() event after all IKE-specific tasks ran

Browse Source 
This makes sure the event is only triggered after the IKE_SA is fully
established and e.g. virtual IPs, additional peer addresses or
a modified reauth time (on the initiator) are assigned to it.  This was
e.g. a problem for the selinux plugin if virtual IPs are used.

We use a separate task to trigger the event that's queued before the
child-create task so the event is triggered before the child_updown()
event.  Same goes for the state change to IKE_ESTABLISHED.

A new condition is used to indicate the successful completion of all
authentication rounds, so we don't have to set the IKE_ESTABLISHED state
in the ike-auth task (it was used as condition in other tasks).

Since set_state() also sets the rekey and reauth times, this required
some minor changes in regards to how AUTH_LIFETIME notifies are handled.
This commit is contained in:
Tobias Brunner
2022-09-23 16:28:35 +02:00
parent 14243dcdb5
commit 5ce1c91b58
17 changed files with 236 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/Android.mk
+1
View File
@@ -103,6 +103,7 @@ sa/ikev2/tasks/ike_cert_post.c sa/ikev2/tasks/ike_cert_post.h \
sa/ikev2/tasks/ike_config.c sa/ikev2/tasks/ike_config.h \
sa/ikev2/tasks/ike_delete.c sa/ikev2/tasks/ike_delete.h \
sa/ikev2/tasks/ike_dpd.c sa/ikev2/tasks/ike_dpd.h \
sa/ikev2/tasks/ike_establish.c sa/ikev2/tasks/ike_establish.h \
sa/ikev2/tasks/ike_init.c sa/ikev2/tasks/ike_init.h \
sa/ikev2/tasks/ike_natd.c sa/ikev2/tasks/ike_natd.h \
sa/ikev2/tasks/ike_mid_sync.c sa/ikev2/tasks/ike_mid_sync.h \