From 66fffdb1bf819e1d55ed3097593f6417c39e1044 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 27 Mar 2026 12:07:19 +0100 Subject: [PATCH] ike-init: Remove redundant check for more key exchanges during rekeying We only call derive_keys() after a successful key_exchange_done() call during rekeying, so this will always return FALSE. --- src/libcharon/sa/ikev2/tasks/ike_init.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c index ca938c605..04ef27e2f 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_init.c +++ b/src/libcharon/sa/ikev2/tasks/ike_init.c @@ -1004,10 +1004,6 @@ static bool derive_keys_internal(private_ike_init_t *this, chunk_t nonce_i, if (this->old_sa) { - if (additional_key_exchange_required(this)) - { /* when rekeying, we only derive keys once all exchanges are done */ - return FALSE; - } old_sa = this->old_sa; kes = this->kes; }