ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

ikev1: Send DELETE for rekeyed IKE_SAs 

If we silently delete the IKE_SA the other peer might still use it even
if only to send DPDs.  If we don't answer to DPDs that might result in the
deletion of the new IKE_SA too.
This commit is contained in:
Tobias Brunner 2016-08-22 12:26:05 +02:00
parent 9691e537cd
commit ebc6445de8
1 changed files with 5 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/libcharon/sa/ike_sa.c
View File

@ -1781,16 +1781,12 @@ METHOD(ike_sa_t, delete_, status_t,
{
switch (this->state)
{
case IKE_REKEYING:
if (this->version == IKEV1)
{ /* SA has been reauthenticated, delete */
charon->bus->ike_updown(charon->bus, &this->public, FALSE);
break;
}
/* FALL */
case IKE_ESTABLISHED:
if (time_monotonic(NULL) >= this->stats[STAT_DELETE])
{ /* IKE_SA hard lifetime hit */
case IKE_REKEYING:
if (time_monotonic(NULL) >= this->stats[STAT_DELETE] &&
!(this->version == IKEV1 && this->state == IKE_REKEYING))
{ /* IKE_SA hard lifetime hit, ignored for reauthenticated
* IKEv1 SAs */
charon->bus->alert(charon->bus, ALERT_IKE_SA_EXPIRED);
}
this->task_manager->queue_ike_delete(this->task_manager);