denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

systime-fix: Unregister validator also if time got valid

Browse Source 
This avoids accepting expired certificates again should the time get
rolled back for some reason.

Fixes: c81b87ac26 ("systime-fix: Add timeout option to stop waiting for valid system time")
Fixes: 295e42a47f ("systime-fix disables certificate lifetime validation if system time not synced")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:36 +02:00
parent be4b9f4aaa
commit dd94e8d70e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/systime_fix/systime_fix_plugin.c
+3 -3
View File
@@ -158,14 +158,14 @@ static job_requeue_t check_systime(private_systime_fix_plugin_t *this)
} }
DBG1(DBG_CFG, "timeout reached while waiting for valid system time, " DBG1(DBG_CFG, "timeout reached while waiting for valid system time, "
"force rechecking certificates"); "force rechecking certificates");
/* force regular lifetime checks for new connections */
lib->credmgr->remove_validator(lib->credmgr,
&this->validator->validator);
} }
else else
{ {
DBG1(DBG_CFG, "system time got valid, rechecking certificates"); DBG1(DBG_CFG, "system time got valid, rechecking certificates");
} }
/* force regular lifetime checks for new connections */
lib->credmgr->remove_validator(lib->credmgr,
&this->validator->validator);
enumerator = charon->ike_sa_manager->create_enumerator( enumerator = charon->ike_sa_manager->create_enumerator(
charon->ike_sa_manager, TRUE); charon->ike_sa_manager, TRUE);