denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame

Browse Source
This commit is contained in:
Tobias Brunner
2013-03-19 12:00:00 +01:00
parent 7a87381840
commit 8a0a1ae857
3 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+8 -1
View File
@@ -30,6 +30,7 @@
#include <sa/ikev1/tasks/informational.h>
#include <sa/ikev1/tasks/isakmp_delete.h>
#include <processing/jobs/adopt_children_job.h>
#include <processing/jobs/delete_ike_sa_job.h>
typedef struct private_aggressive_mode_t private_aggressive_mode_t;
@@ -299,8 +300,14 @@ METHOD(task_t, build_i, status_t,
case AUTH_XAUTH_INIT_PSK:
case AUTH_XAUTH_INIT_RSA:
case AUTH_HYBRID_INIT_RSA:
/* wait for XAUTH request */
{ /* wait for XAUTH request, since this may never come,
* we queue a timeout */
job_t *job = (job_t*)delete_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
lib->scheduler->schedule_job(lib->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
break;
}
case AUTH_XAUTH_RESP_PSK:
case AUTH_XAUTH_RESP_RSA:
case AUTH_HYBRID_RESP_RSA:
src/libcharon/sa/ikev1/tasks/main_mode.c
+8 -1
View File
@@ -30,6 +30,7 @@
#include <sa/ikev1/tasks/informational.h>
#include <sa/ikev1/tasks/isakmp_delete.h>
#include <processing/jobs/adopt_children_job.h>
#include <processing/jobs/delete_ike_sa_job.h>
typedef struct private_main_mode_t private_main_mode_t;
@@ -638,8 +639,14 @@ METHOD(task_t, process_i, status_t,
case AUTH_XAUTH_INIT_PSK:
case AUTH_XAUTH_INIT_RSA:
case AUTH_HYBRID_INIT_RSA:
/* wait for XAUTH request */
{ /* wait for XAUTH request, since this may never come,
* we queue a timeout */
job_t *job = (job_t*)delete_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
lib->scheduler->schedule_job(lib->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
break;
}
case AUTH_XAUTH_RESP_PSK:
case AUTH_XAUTH_RESP_RSA:
case AUTH_HYBRID_RESP_RSA: