diff options
| author | Christophe Gouault <christophe.gouault@6wind.com> | 2014-07-11 13:40:25 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-08-25 09:45:14 +0200 |
| commit | c08b74c52465a142143affaf4241c4497ba2e425 (patch) | |
| tree | f24057cbab5c8df274850460a9858c2c39f9f538 /src/libstrongswan | |
| parent | 46184b07c1637abcd84629d35aad34d85ffba3d7 (diff) | |
| download | strongswan-c08b74c52465a142143affaf4241c4497ba2e425.tar.bz2 strongswan-c08b74c52465a142143affaf4241c4497ba2e425.tar.xz | |
ike-sa-manager: Use transient hasher for IKE_SA_INIT hash calculation
To check if a received IKE_SA_INIT request is a new request or a
retransmit, charon maintains hashes of the pending IKE_SA_INIT
exchanges.
However, the hash calculation is not reentrant because a single hasher
is used for the whole IKE SA manager. It leads to bogus calculations
under high load and hence dropped messages on responder
(IkeInInvalidSpi incremented).
Don't share a single hasher in the IKE SA manager, create a transient
one whenever a message must be hashed.
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
Diffstat (limited to 'src/libstrongswan')
0 files changed, 0 insertions, 0 deletions