From ebc6defa0582bf2c022589371255046b06fc6b08 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 1 Mar 2018 17:53:59 +0100 Subject: [PATCH 1/3] ikev1: Reestablish SAs if reauthentication failed due to retransmits --- src/libcharon/sa/ike_sa.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index 7fe6d112b..7f272a95b 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -2347,6 +2347,15 @@ METHOD(ike_sa_t, retransmit, status_t, return this->task_manager->initiate(this->task_manager); } DBG1(DBG_IKE, "establishing IKE_SA failed, peer not responding"); + + if (this->version == IKEV1 && array_count(this->child_sas)) + { + /* if reauthenticating an IKEv1 SA failed (assumed for an SA + * in this state with CHILD_SAs), try again from scratch */ + DBG1(DBG_IKE, "reauthentication failed, trying to " + "reestablish IKE_SA"); + reestablish(this); + } break; } case IKE_DELETING: From eb82210620e0e4f297fdb0274f1ab8e1015971fd Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 1 Mar 2018 18:02:08 +0100 Subject: [PATCH 2/3] ikev1: Trigger down events for CHILD_SAs if reauthentication failed due to retransmits --- src/libcharon/sa/ike_sa.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index 7f272a95b..c6cacdf9c 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -2350,11 +2350,27 @@ METHOD(ike_sa_t, retransmit, status_t, if (this->version == IKEV1 && array_count(this->child_sas)) { + enumerator_t *enumerator; + child_sa_t *child_sa; + /* if reauthenticating an IKEv1 SA failed (assumed for an SA * in this state with CHILD_SAs), try again from scratch */ DBG1(DBG_IKE, "reauthentication failed, trying to " "reestablish IKE_SA"); reestablish(this); + /* trigger down events for the CHILD_SAs, as no down event + * is triggered below for IKE SAs in this state */ + enumerator = array_create_enumerator(this->child_sas); + while (enumerator->enumerate(enumerator, &child_sa)) + { + if (child_sa->get_state(child_sa) != CHILD_REKEYED && + child_sa->get_state(child_sa) != CHILD_DELETED) + { + charon->bus->child_updown(charon->bus, child_sa, + FALSE); + } + } + enumerator->destroy(enumerator); } break; } From 40ec7f998a36111908742f86ed6681e6793e401b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 12 Mar 2018 10:20:42 +0100 Subject: [PATCH 3/3] _updown: Remove printf calls for identities This was apparently for compatibility with pluto, which escaped some characters as octal values. --- src/_updown/_updown.in | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in index e549e9597..5f709637e 100644 --- a/src/_updown/_updown.in +++ b/src/_updown/_updown.in @@ -215,10 +215,6 @@ then fi fi -# resolve octal escape sequences -PLUTO_MY_ID=`printf "$PLUTO_MY_ID"` -PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"` - case "$PLUTO_VERB:$1" in up-host:) # connection to me coming up