denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-sa: Only query last use time of CHILD_SAs if UDP-encap is used

Browse Source 
Without UDP-encapsulation, the IKE and ESP traffic is not directly related
(other than via IPs), so firewalls might no keep the state for IKE traffic
alive if there is no IKE traffic for a while and constant ESP traffic
prevents DPDs from being exchanged because inbound ESP traffic is
considered.

Closes strongswan/strongswan#1759
This commit is contained in:
Tobias Brunner
2025-02-28 16:19:02 +01:00
parent 57703fa089
commit 882b19c1df
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+10 -6
View File
@@ -369,14 +369,18 @@ static time_t get_use_time(private_ike_sa_t* this, bool inbound)
use_time = this->stats[STAT_OUTBOUND];
}
enumerator = array_create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, &child_sa))
/* only consider IPsec traffic if we use UDP-encapsulation and they take
* the same path */
if (this->public.has_condition(&this->public, COND_NAT_ANY))
{
child_sa->get_usestats(child_sa, inbound, &current, NULL, NULL);
use_time = max(use_time, current);
enumerator = array_create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, &child_sa))
{
child_sa->get_usestats(child_sa, inbound, &current, NULL, NULL);
use_time = max(use_time, current);
}
enumerator->destroy(enumerator);
}
enumerator->destroy(enumerator);
return use_time;
}