Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/crypto/dist/ipsec-tools/src/racoon Purge all IPsec-SA's if t...
details: https://anonhg.NetBSD.org/src/rev/22c1f2a88c0f
branches: trunk
changeset: 758652:22c1f2a88c0f
user: tteras <tteras%NetBSD.org@localhost>
date: Fri Nov 12 09:11:37 2010 +0000
description:
Purge all IPsec-SA's if the last main ISAKMP-SA for the node is deleted
by remote request and the phase1 rekeying is enabled (this will also
trigger the new phase1_dead script hook).
diffstat:
crypto/dist/ipsec-tools/src/racoon/isakmp.c | 30 +++++++++++++++++++++-------
1 files changed, 22 insertions(+), 8 deletions(-)
diffs (59 lines):
diff -r b42faded4124 -r 22c1f2a88c0f crypto/dist/ipsec-tools/src/racoon/isakmp.c
--- a/crypto/dist/ipsec-tools/src/racoon/isakmp.c Fri Nov 12 09:09:47 2010 +0000
+++ b/crypto/dist/ipsec-tools/src/racoon/isakmp.c Fri Nov 12 09:11:37 2010 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: isakmp.c,v 1.63 2010/10/21 06:15:28 tteras Exp $ */
+/* $NetBSD: isakmp.c,v 1.64 2010/11/12 09:11:37 tteras Exp $ */
/* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
@@ -766,6 +766,20 @@
return 0;
}
+static int
+ph1_rekey_enabled(iph1)
+ struct ph1handle *iph1;
+{
+ if (iph1->rmconf->rekey == REKEY_FORCE)
+ return 1;
+#ifdef ENABLE_DPD
+ if (iph1->rmconf->rekey == REKEY_ON && iph1->dpd_support &&
+ iph1->rmconf->dpd_interval)
+ return 1;
+#endif
+ return 0;
+}
+
/*
* main function of phase 1.
*/
@@ -866,13 +880,7 @@
migrate_dying_ph12(iph1);
/* add to the schedule to expire, and seve back pointer. */
- if ((iph1->rmconf->rekey == REKEY_FORCE)
-#ifdef ENABLE_DPD
- ||
- (iph1->rmconf->rekey == REKEY_ON && iph1->dpd_support &&
- iph1->rmconf->dpd_interval)
-#endif
- ) {
+ if (ph1_rekey_enabled(iph1)) {
sched_schedule(&iph1->sce,
iph1->approval->lifetime *
PFKEY_SOFT_LIFETIME_RATE / 100,
@@ -2071,7 +2079,13 @@
plog(LLV_INFO, LOCATION, NULL,
"ISAKMP-SA deleted %s-%s spi:%s\n",
src, dst, isakmp_pindex(&iph1->index, 0));
+
evt_phase1(iph1, EVT_PHASE1_DOWN, NULL);
+
+ if (new_iph1 == NULL && ph1_rekey_enabled(iph1)) {
+ purge_remote(iph1);
+ script_hook(iph1, SCRIPT_PHASE1_DEAD);
+ }
racoon_free(src);
racoon_free(dst);
Home |
Main Index |
Thread Index |
Old Index