diff options
| author | Martin Willi <martin@revosec.ch> | 2013-11-07 09:21:02 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-01-23 16:19:22 +0100 |
| commit | d048a319df412ee7966a898caed2ac93f0eae1b1 (patch) | |
| tree | e8d866167514de48dffd9c6d8b63054d9d6c7580 /src/libcharon/processing | |
| parent | 763e035335169872cd9681d46b24fa1120ea925d (diff) | |
| download | strongswan-d048a319df412ee7966a898caed2ac93f0eae1b1.tar.bz2 strongswan-d048a319df412ee7966a898caed2ac93f0eae1b1.tar.xz | |
ike: Restart inactivity counter after doing a CHILD_SA rekey
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.
This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
Diffstat (limited to 'src/libcharon/processing')
| -rw-r--r-- | src/libcharon/processing/jobs/inactivity_job.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/libcharon/processing/jobs/inactivity_job.c b/src/libcharon/processing/jobs/inactivity_job.c index 9ab69b417..197733979 100644 --- a/src/libcharon/processing/jobs/inactivity_job.c +++ b/src/libcharon/processing/jobs/inactivity_job.c @@ -73,12 +73,13 @@ METHOD(job_t, execute, job_requeue_t, { if (child_sa->get_reqid(child_sa) == this->reqid) { - time_t in, out, diff; + time_t in, out, install, diff; child_sa->get_usestats(child_sa, TRUE, &in, NULL, NULL); child_sa->get_usestats(child_sa, FALSE, &out, NULL, NULL); + install = child_sa->get_installtime(child_sa); - diff = time_monotonic(NULL) - max(in, out); + diff = time_monotonic(NULL) - max(max(in, out), install); if (diff >= this->timeout) { |