denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-rekey: Respond with TEMPORARY_FAILURE if CHILD_SAs are currently rekeyed/deleted/established

Browse Source
This commit is contained in:
Tobias Brunner
2016-06-17 18:48:05 +02:00
parent 7015994a94
commit 83191e56b2
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_rekey.c
+8 -1
View File
@@ -67,6 +67,11 @@ struct private_ike_rekey_t {
* colliding task detected by the task manager * colliding task detected by the task manager
*/ */
task_t *collision; task_t *collision;
/**
* TRUE if rekeying can't be handled temporarily
*/
bool failed_temporarily;
}; };
/** /**
@@ -186,6 +191,7 @@ METHOD(task_t, process_r, status_t,
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING) if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{ {
DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting"); DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
this->failed_temporarily = TRUE;
return NEED_MORE; return NEED_MORE;
} }
@@ -201,6 +207,7 @@ METHOD(task_t, process_r, status_t,
/* we do not allow rekeying while we have children in-progress */ /* we do not allow rekeying while we have children in-progress */
DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open"); DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
this->failed_temporarily = TRUE;
return NEED_MORE; return NEED_MORE;
default: default:
break; break;
@@ -224,7 +231,7 @@ METHOD(task_t, process_r, status_t,
METHOD(task_t, build_r, status_t, METHOD(task_t, build_r, status_t,
private_ike_rekey_t *this, message_t *message) private_ike_rekey_t *this, message_t *message)
{ {
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING) if (this->failed_temporarily)
{ {
message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty); message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty);
return SUCCESS; return SUCCESS;