From dd94e8d70ed67aabbdea70562bd3ce1ee6a161cc Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 24 Jun 2026 11:15:39 +0200 Subject: [PATCH] systime-fix: Unregister validator also if time got valid This avoids accepting expired certificates again should the time get rolled back for some reason. Fixes: c81b87ac265e ("systime-fix: Add timeout option to stop waiting for valid system time") Fixes: 295e42a47f9a ("systime-fix disables certificate lifetime validation if system time not synced") --- src/libcharon/plugins/systime_fix/systime_fix_plugin.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c index 878ccb851..56ac329d4 100644 --- a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c +++ b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c @@ -158,14 +158,14 @@ static job_requeue_t check_systime(private_systime_fix_plugin_t *this) } DBG1(DBG_CFG, "timeout reached while waiting for valid system time, " "force rechecking certificates"); - /* force regular lifetime checks for new connections */ - lib->credmgr->remove_validator(lib->credmgr, - &this->validator->validator); } else { DBG1(DBG_CFG, "system time got valid, rechecking certificates"); } + /* force regular lifetime checks for new connections */ + lib->credmgr->remove_validator(lib->credmgr, + &this->validator->validator); enumerator = charon->ike_sa_manager->create_enumerator( charon->ike_sa_manager, TRUE);