diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2013-07-10 11:08:01 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-07-17 17:45:17 +0200 |
| commit | bbd9df25a9410fcde8cb594e5c789cad5506d5ed (patch) | |
| tree | a2a715f22022775dba69684d3a98425f8e76f941 /src/libcharon/plugins/unity/unity_provider.c | |
| parent | a9f14ada34554bc42b819f8196899a002bade27b (diff) | |
| download | strongswan-bbd9df25a9410fcde8cb594e5c789cad5506d5ed.tar.bz2 strongswan-bbd9df25a9410fcde8cb594e5c789cad5506d5ed.tar.xz | |
kernel-pfkey: Remove latest IPsec SA mapping when deleting a policy
If IPsec SAs are rekeyed due to an address change (e.g. because
update_sa is not supported) the exact same policy with the same reqid
will be installed, but with different addresses. After the rekeying the
old SA and its policies are removed, using the first matching mapping
breaks the mapping between the policies and the new SA (at least on
FreeBSD, the Linux kernel might only use the reqid for this). Using the
oldest matching SA is still an approximation but it solves the above
issue.
Diffstat (limited to 'src/libcharon/plugins/unity/unity_provider.c')
0 files changed, 0 insertions, 0 deletions