denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "child-sa: Remove the obsolete update logic"

Browse Source 
While the the meaning of the "inbound" flag on the kernel_interface->add_sa()
call is not very clear, we still need that update logic to allow installation of
inbound SAs without SPI allocation. This is used in the HA plugin as a passive
node.

This reverts commit 698ed656.
This commit is contained in:
Martin Willi
2015-03-09 18:18:20 +01:00
parent 8be21ae7ef
commit acad5e9f51
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+6 -1
View File
@@ -655,6 +655,7 @@ METHOD(child_sa_t, install, status_t,
u_int32_t tfc = 0; u_int32_t tfc = 0;
host_t *src, *dst; host_t *src, *dst;
status_t status; status_t status;
bool update = FALSE;
/* now we have to decide which spi to use. Use self allocated, if "in", /* now we have to decide which spi to use. Use self allocated, if "in",
* or the one in the proposal, if not "in" (others). Additionally, * or the one in the proposal, if not "in" (others). Additionally,
@@ -663,6 +664,10 @@ METHOD(child_sa_t, install, status_t,
{ {
dst = this->my_addr; dst = this->my_addr;
src = this->other_addr; src = this->other_addr;
if (this->my_spi == spi)
{ /* alloc_spi has been called, do an SA update */
update = TRUE;
}
this->my_spi = spi; this->my_spi = spi;
this->my_cpi = cpi; this->my_cpi = cpi;
} }
@@ -745,7 +750,7 @@ METHOD(child_sa_t, install, status_t,
inbound ? this->mark_in : this->mark_out, tfc, inbound ? this->mark_in : this->mark_out, tfc,
lifetime, enc_alg, encr, int_alg, integ, this->mode, lifetime, enc_alg, encr, int_alg, integ, this->mode,
this->ipcomp, cpi, this->config->get_replay_window(this->config), this->ipcomp, cpi, this->config->get_replay_window(this->config),
initiator, this->encap, esn, inbound, src_ts, dst_ts); initiator, this->encap, esn, update, src_ts, dst_ts);
free(lifetime); free(lifetime);