denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't rekey but delete CHILD_SA to resying against NATed Windows clients

Browse Source
This commit is contained in:
Martin Willi
2011-08-19 09:16:17 +02:00
parent f54bcf35af
commit bff1025201
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_cache.c
+18 -3
View File
@@ -203,9 +203,24 @@ static status_t rekey_children(ike_sa_t *ike_sa)
enumerator = ike_sa->create_child_sa_enumerator(ike_sa);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
DBG1(DBG_CFG, "resyncing CHILD_SA");
status = ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
if (ike_sa->supports_extension(ike_sa, EXT_MS_WINDOWS) &&
ike_sa->has_condition(ike_sa, COND_NAT_THERE))
{
/* NATed Windows clients don't accept CHILD_SA rekeying, but fail
* with an "invalid situation" error. We just close the CHILD_SA,
* Windows will reestablish it immediately if required. */
DBG1(DBG_CFG, "resyncing CHILD_SA using a delete");
status = ike_sa->delete_child_sa(ike_sa,
child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
}
else
{
DBG1(DBG_CFG, "resyncing CHILD_SA using a rekey");
status = ike_sa->rekey_child_sa(ike_sa,
child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
}
if (status == DESTROY_ME)
{
break;