From 2265fcd1b44e79722a00d8b21d8dd921acd7a7a2 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 24 Aug 2026 16:21:49 +0200 Subject: [PATCH] stroke: Avoid underflow when reporting number of SAs Since 5.9.6, the number of half-open SAs includes queued initial IKE messages. So that number could be higher than the number of managed SAs, which causes an underflow in the output. Fixes: b866ee88bf54 ("ike: Track unprocessed initial IKE messages like half-open IKE_SAs") --- src/libcharon/plugins/stroke/stroke_list.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c index afa6a0e7f..e8e982037 100644 --- a/src/libcharon/plugins/stroke/stroke_list.c +++ b/src/libcharon/plugins/stroke/stroke_list.c @@ -645,9 +645,8 @@ METHOD(stroke_list_t, status, void, half_open = charon->ike_sa_manager->get_half_open_count( charon->ike_sa_manager, NULL, FALSE); - fprintf(out, "Security Associations (%u up, %u connecting):\n", - charon->ike_sa_manager->get_count(charon->ike_sa_manager) - half_open, - half_open); + fprintf(out, "Security Associations (%u total, %u connecting):\n", + charon->ike_sa_manager->get_count(charon->ike_sa_manager), half_open); enumerator = charon->controller->create_ike_sa_enumerator( charon->controller, wait); while (enumerator->enumerate(enumerator, &ike_sa) && ferror(out) == 0)