denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying

Browse Source
This commit is contained in:
Martin Willi
2013-02-20 08:57:17 +01:00
parent 7a93844f21
commit f836d433a9
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+21
View File
@@ -1745,6 +1745,23 @@ METHOD(ike_sa_manager_t, create_id_enumerator, enumerator_t*,
(void*)id_enumerator_cleanup, ids);
}
/**
* Move all CHILD_SAs from old to new
*/
static void adopt_children(ike_sa_t *old, ike_sa_t *new)
{
enumerator_t *enumerator;
child_sa_t *child_sa;
enumerator = old->create_child_sa_enumerator(old);
while (enumerator->enumerate(enumerator, &child_sa))
{
old->remove_child_sa(old, enumerator);
new->add_child_sa(new, child_sa);
}
enumerator->destroy(enumerator);
}
METHOD(ike_sa_manager_t, check_uniqueness, bool,
private_ike_sa_manager_t *this, ike_sa_t *ike_sa, bool force_replace)
{
@@ -1796,6 +1813,10 @@ METHOD(ike_sa_manager_t, check_uniqueness, bool,
{
case UNIQUE_REPLACE:
charon->bus->alert(charon->bus, ALERT_UNIQUE_REPLACE);
if (duplicate->get_version(duplicate) == IKEV1)
{
adopt_children(duplicate, ike_sa);
}
DBG1(DBG_IKE, "deleting duplicate IKE_SA for peer "
"'%Y' due to uniqueness policy", other);
status = duplicate->delete(duplicate);