From cef4bce3e125ac1dbcd9c84437d1aaf4ad37032d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 19 Jun 2026 12:33:01 +0200 Subject: [PATCH] controller: Properly notify waiting thread after INVALID_KE_PAYLOAD retry failed When initiating a Child SA with a CREATE_CHILD_SA exchange, the initial exchange could fail with an INVALID_KE_PAYLOAD notify. The initiation would then get retried from scratch (the `child_sa_t` object is destroyed and a new one created). If it fails again, the previous code didn't signal the waiting thread. If it did not set a timeout, it would wait indefinitely. Using a different `status_t` value avoids any confusion with NEED_MORE that's used to indicate that the callback returned FALSE (e.g. if the IKE_SA would go down before concluding the retry). Fixes: c39b0c883dc6 ("controller: Keep following initiate() if the first DH guess was wrong") --- src/libcharon/control/controller.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c index 42a4822bb..c3d0b67a1 100644 --- a/src/libcharon/control/controller.c +++ b/src/libcharon/control/controller.c @@ -341,13 +341,12 @@ METHOD(listener_t, child_state_change, bool, case CHILD_RETRYING: /* retrying with a different DH group; survive another * initiation round */ - this->status = NEED_MORE; + this->status = INVALID_ARG; return TRUE; case CHILD_CREATED: - if (this->status == NEED_MORE) + if (this->status == INVALID_ARG) { this->status = FAILED; - return TRUE; } break; default: