denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: If a IKE reauth_time is configured, disable the default rekey_time

Browse Source
This commit is contained in:
Martin Willi
2015-03-03 13:49:14 +01:00
parent 1cce0df4a6
commit f6511e36b5
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+16 -1
View File
@@ -1751,7 +1751,8 @@ CALLBACK(config_sn, bool,
.fragmentation = FRAGMENTATION_NO,
.unique = UNIQUE_NO,
.keyingtries = 1,
.rekey_time = LFT_DEFAULT_IKE_REKEY,
.rekey_time = LFT_UNDEFINED,
.reauth_time = LFT_UNDEFINED,
.over_time = LFT_UNDEFINED,
.rand_time = LFT_UNDEFINED,
};
@@ -1809,6 +1810,20 @@ CALLBACK(config_sn, bool,
peer.local_port = charon->socket->get_port(charon->socket, FALSE);
}
if (peer.rekey_time == LFT_UNDEFINED && peer.reauth_time == LFT_UNDEFINED)
{
/* apply a default rekey time if no rekey/reauth time set */
peer.rekey_time = LFT_DEFAULT_IKE_REKEY;
peer.reauth_time = 0;
}
if (peer.rekey_time == LFT_UNDEFINED)
{
peer.rekey_time = 0;
}
if (peer.reauth_time == LFT_UNDEFINED)
{
peer.reauth_time = 0;
}
if (peer.over_time == LFT_UNDEFINED)
{
/* default over_time to 10% of rekey/reauth time if not given */