denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-rekey: Ignore colliding rekey tasks that did not create an IKE_SA

Browse Source 
This simplifies collision handling and we don't need to know about these
tasks when concluding the rekeying we initiated.
This commit is contained in:
Tobias Brunner
2016-06-17 18:48:06 +02:00
parent 1b989dd4c5
commit 724d65900c
1 changed files with 64 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_rekey.c
+31 -23
View File
@@ -304,10 +304,6 @@ METHOD(task_t, process_i, status_t,
this->collision->get_type(this->collision) == TASK_IKE_REKEY)
{
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
/* ike_init can be NULL, if child_sa is half-open */
if (other->ike_init)
{
host_t *host;
chunk_t this_nonce, other_nonce;
@@ -317,23 +313,7 @@ METHOD(task_t, process_i, status_t,
/* if we have the lower nonce, delete rekeyed SA. If not, delete
* the redundant. */
if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) > 0)
{
/* peer should delete this SA. Add a timeout just in case. */
job_t *job = (job_t*)delete_ike_sa_job_create(
other->new_sa->get_id(other->new_sa), TRUE);
lib->scheduler->schedule_job(lib->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
DBG1(DBG_IKE, "IKE_SA rekey collision won, waiting for delete "
"for redundant IKE_SA %s[%d]",
other->new_sa->get_name(other->new_sa),
other->new_sa->get_unique_id(other->new_sa));
other->new_sa->set_state(other->new_sa, IKE_REKEYED);
charon->ike_sa_manager->checkin(charon->ike_sa_manager,
other->new_sa);
other->new_sa = NULL;
}
else
min(this_nonce.len, other_nonce.len)) < 0)
{
DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant "
"IKE_SA %s[%d]", this->new_sa->get_name(this->new_sa),
@@ -360,7 +340,17 @@ METHOD(task_t, process_i, status_t,
establish_new(other);
return SUCCESS;
}
}
/* peer should delete this SA. Add a timeout just in case. */
job_t *job = (job_t*)delete_ike_sa_job_create(
other->new_sa->get_id(other->new_sa), TRUE);
lib->scheduler->schedule_job(lib->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
DBG1(DBG_IKE, "IKE_SA rekey collision won, waiting for delete for "
"redundant IKE_SA %s[%d]", other->new_sa->get_name(other->new_sa),
other->new_sa->get_unique_id(other->new_sa));
other->new_sa->set_state(other->new_sa, IKE_REKEYED);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
other->new_sa = NULL;
charon->bus->set_sa(charon->bus, this->ike_sa);
}
@@ -392,8 +382,10 @@ METHOD(ike_rekey_t, collide, void,
{
DBG1(DBG_IKE, "detected %N collision with %N", task_type_names,
TASK_IKE_REKEY, task_type_names, other->get_type(other));
if (other->get_type(other) == TASK_IKE_DELETE)
switch (other->get_type(other))
{
case TASK_IKE_DELETE:
if (this->collision &&
this->collision->get_type(this->collision) == TASK_IKE_REKEY)
{
@@ -402,6 +394,22 @@ METHOD(ike_rekey_t, collide, void,
establish_new((private_ike_rekey_t*)this->collision);
return;
}
break;
case TASK_IKE_REKEY:
{
private_ike_rekey_t *rekey = (private_ike_rekey_t*)other;
if (!rekey->ike_init)
{
DBG1(DBG_IKE, "colliding exchange did not result in an IKE_SA, "
"ignore");
other->destroy(other);
return;
}
break;
}
default:
break;
}
DESTROY_IF(this->collision);
this->collision = other;