denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs

Browse Source 
After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't
destroy the CHILD_SA (and the inbound SA) immediately.  We delay it
a few seconds or until the SA expires to allow delayed packets to get
processed. The CHILD_SA remains in state CHILD_DELETING until it finally
gets destroyed.
This commit is contained in:
Tobias Brunner
2017-05-23 18:46:49 +02:00
parent ba0796fe75
commit 44107cb7b7
4 changed files with 422 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+10
View File
@@ -75,6 +75,16 @@ charon.delete_rekeyed = no
However, this might cause problems with implementations that continue to
use rekeyed SAs until they expire.
charon.delete_rekeyed_delay = 5
Delay in seconds until inbound IPsec SAs are deleted after rekeyings (IKEv2
only).
Delay in seconds until inbound IPsec SAs are deleted after rekeyings (IKEv2
only). To process delayed packets the inbound part of a CHILD_SA is kept
installed up to the configured number of seconds after it got replaced
during a rekeying. If set to 0 the CHILD_SA will be kept installed until it
expires (if no lifetime is set it will be destroyed immediately).
charon.dh_exponent_ansi_x9_42 = yes
Use ANSI X9.42 DH exponent size or optimum size matched to cryptographic
strength.