denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: If a IKE reauth_time is configured, disable the default rekey_time

Browse Source
This commit is contained in:
Martin Willi
2015-03-03 13:49:14 +01:00
parent 1cce0df4a6
commit f6511e36b5
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+16 -1
View File
@@ -1751,7 +1751,8 @@ CALLBACK(config_sn, bool,
.fragmentation = FRAGMENTATION_NO,
.unique = UNIQUE_NO,
.keyingtries = 1,
.rekey_time = LFT_DEFAULT_IKE_REKEY,
.rekey_time = LFT_UNDEFINED,
.reauth_time = LFT_UNDEFINED,
.over_time = LFT_UNDEFINED,
.rand_time = LFT_UNDEFINED,
};
@@ -1809,6 +1810,20 @@ CALLBACK(config_sn, bool,
peer.local_port = charon->socket->get_port(charon->socket, FALSE);
}
if (peer.rekey_time == LFT_UNDEFINED && peer.reauth_time == LFT_UNDEFINED)
{
/* apply a default rekey time if no rekey/reauth time set */
peer.rekey_time = LFT_DEFAULT_IKE_REKEY;
peer.reauth_time = 0;
}
if (peer.rekey_time == LFT_UNDEFINED)
{
peer.rekey_time = 0;
}
if (peer.reauth_time == LFT_UNDEFINED)
{
peer.reauth_time = 0;
}
if (peer.over_time == LFT_UNDEFINED)
{
/* default over_time to 10% of rekey/reauth time if not given */
src/swanctl/swanctl.opt
+3 -1
View File
@@ -220,7 +220,9 @@ connections.<conn>.rekey_time = 4h
IKEv1 performs a reauthentication procedure instead.
With the default value IKE rekeying is scheduled every 4 hours, minus the
configured **rand_time**.
configured **rand_time**. If a **reauth_time** is configured, **rekey_time**
defaults to zero disabling rekeying; explicitly set both to enforce
rekeying and reauthentication.
connections.<conn>.over_time = 10% of rekey_time/reauth_time
Hard IKE_SA lifetime if rekey/reauth does not complete, as time.