From ebc6445de8abfd719ab41b447bc9bc6e4c5c1ada Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 22 Aug 2016 12:26:05 +0200 Subject: [PATCH 1/3] ikev1: Send DELETE for rekeyed IKE_SAs If we silently delete the IKE_SA the other peer might still use it even if only to send DPDs. If we don't answer to DPDs that might result in the deletion of the new IKE_SA too. --- src/libcharon/sa/ike_sa.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index ceeafcbb8..7b87918d3 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -1781,16 +1781,12 @@ METHOD(ike_sa_t, delete_, status_t, { switch (this->state) { - case IKE_REKEYING: - if (this->version == IKEV1) - { /* SA has been reauthenticated, delete */ - charon->bus->ike_updown(charon->bus, &this->public, FALSE); - break; - } - /* FALL */ case IKE_ESTABLISHED: - if (time_monotonic(NULL) >= this->stats[STAT_DELETE]) - { /* IKE_SA hard lifetime hit */ + case IKE_REKEYING: + if (time_monotonic(NULL) >= this->stats[STAT_DELETE] && + !(this->version == IKEV1 && this->state == IKE_REKEYING)) + { /* IKE_SA hard lifetime hit, ignored for reauthenticated + * IKEv1 SAs */ charon->bus->alert(charon->bus, ALERT_IKE_SA_EXPIRED); } this->task_manager->queue_ike_delete(this->task_manager); From 2e06179f7f50ca9aabe647137ddf029586047e8a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 25 Aug 2016 09:54:17 +0200 Subject: [PATCH 2/3] ikev1: Delete Quick Mode SAs before the ISAKMP SA After the ISAKMP_DELETE task has been executed the IKE_SA is destroyed so we wouldn't be able to send deletes for the Quick Mode SAs. --- src/libcharon/sa/ikev1/task_manager_v1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 117102bce..082afae63 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -515,13 +515,13 @@ METHOD(task_manager_t, initiate, status_t, new_mid = TRUE; break; } - if (activate_task(this, TASK_ISAKMP_DELETE)) + if (activate_task(this, TASK_QUICK_DELETE)) { exchange = INFORMATIONAL_V1; new_mid = TRUE; break; } - if (activate_task(this, TASK_QUICK_DELETE)) + if (activate_task(this, TASK_ISAKMP_DELETE)) { exchange = INFORMATIONAL_V1; new_mid = TRUE; From b56b85025153a273370880bdb57e38b89d9cfcfb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 25 Aug 2016 09:56:45 +0200 Subject: [PATCH 3/3] ikev1: Activate task to delete the IKE_SA in state IKE_REKEYING It does not have any CHILD_SAs attached at that point. --- src/libcharon/sa/ikev1/task_manager_v1.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 082afae63..37112b35c 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -547,6 +547,14 @@ METHOD(task_manager_t, initiate, status_t, break; } break; + case IKE_REKEYING: + if (activate_task(this, TASK_ISAKMP_DELETE)) + { + exchange = INFORMATIONAL_V1; + new_mid = TRUE; + break; + } + break; default: break; }