sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-06 00:00:47 -04:00
Code Issues Projects Releases Wiki Activity

ikev2: Send deletes also for rekeyed SAs

Browse Source 
This way we can use the IKE_REKEYED state for both redundant and old SAs
to suppress ike_updown().

In the ike-delete task we don't suppress events in state IKE_REKEYING as
that's the case when we delete an SA the peer is currently rekeying with
multiple key exchanges.
This commit is contained in:
Tobias Brunner 2020-06-17 16:04:10 +02:00 committed by Andreas Steffen
parent 54163948ae
commit 50d0c7f9de
3 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/libcharon/sa/ike_sa.c
View File

@ -1884,6 +1884,7 @@ METHOD(ike_sa_t, delete_, status_t,
{ {
case IKE_ESTABLISHED: case IKE_ESTABLISHED:
case IKE_REKEYING: case IKE_REKEYING:
case IKE_REKEYED:
if (time_monotonic(NULL) >= this->stats[STAT_DELETE] && if (time_monotonic(NULL) >= this->stats[STAT_DELETE] &&
!(this->version == IKEV1 && this->state == IKE_REKEYING)) !(this->version == IKEV1 && this->state == IKE_REKEYING))
{ /* IKE_SA hard lifetime hit, ignored for reauthenticated { /* IKE_SA hard lifetime hit, ignored for reauthenticated

5
src/libcharon/sa/ikev2/tasks/ike_delete.c
View File

@ -64,9 +64,8 @@ METHOD(task_t, build_i, status_t,
delete_payload = delete_payload_create(PLV2_DELETE, PROTO_IKE); delete_payload = delete_payload_create(PLV2_DELETE, PROTO_IKE);
message->add_payload(message, (payload_t*)delete_payload); message->add_payload(message, (payload_t*)delete_payload);
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING || if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYED)
this->ike_sa->get_state(this->ike_sa) == IKE_REKEYED) { /* suppress events when deleting old or redundant SAs */
{
this->rekeyed = TRUE; this->rekeyed = TRUE;
} }
this->ike_sa->set_state(this->ike_sa, IKE_DELETING); this->ike_sa->set_state(this->ike_sa, IKE_DELETING);

4
src/libcharon/sa/ikev2/tasks/ike_rekey.c
View File

@ -375,9 +375,7 @@ METHOD(task_t, process_i, status_t,
this->new_sa->set_my_host(this->new_sa, host->clone(host)); this->new_sa->set_my_host(this->new_sa, host->clone(host));
host = this->ike_sa->get_other_host(this->ike_sa); host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_other_host(this->new_sa, host->clone(host)); this->new_sa->set_other_host(this->new_sa, host->clone(host));
/* IKE_SAs in state IKE_REKEYED are silently deleted, so we use this->new_sa->set_state(this->new_sa, IKE_REKEYED);
* IKE_REKEYING */
this->new_sa->set_state(this->new_sa, IKE_REKEYING);
if (this->new_sa->delete(this->new_sa, FALSE) == DESTROY_ME) if (this->new_sa->delete(this->new_sa, FALSE) == DESTROY_ME)
{ {
this->new_sa->destroy(this->new_sa); this->new_sa->destroy(this->new_sa);