denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame

Browse Source
This commit is contained in:
Tobias Brunner
2013-03-19 12:00:00 +01:00
parent 7a87381840
commit 8a0a1ae857
3 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/processing/jobs/delete_ike_sa_job.c
+11 -1
View File
@@ -76,11 +76,21 @@ METHOD(job_t, execute, job_requeue_t,
}
else
{
/* destroy IKE_SA did not complete connecting phase */
/* destroy IKE_SA only if it did not complete connecting phase */
if (ike_sa->get_state(ike_sa) != IKE_CONNECTING)
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
else if (ike_sa->get_version(ike_sa) == IKEV1 &&
ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
{ /* as initiator we waited for the peer to initiate e.g. an
* XAuth exchange, reauth the SA to eventually trigger DPD */
DBG1(DBG_JOB, "peer did not initiate expected exchange, "
"reestablishing IKE_SA");
ike_sa->reauth(ike_sa);
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, ike_sa);
}
else
{
DBG1(DBG_JOB, "deleting half open IKE_SA after timeout");