child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / child_rekey.c
index 5873a84..761c860 100644 (file)
@@ -132,6 +132,7 @@ static void find_child(private_child_rekey_t *this, message_t *message)
        notify_payload_t *notify;
        protocol_id_t protocol;
        uint32_t spi;
+       child_sa_t *child_sa;
 
        notify = message->get_notify(message, REKEY_SA);
        if (notify)
@@ -141,8 +142,15 @@ static void find_child(private_child_rekey_t *this, message_t *message)
 
                if (protocol == PROTO_ESP || protocol == PROTO_AH)
                {
-                       this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
-                                                                                                               spi, FALSE);
+                       child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
+                                                                                                 spi, FALSE);
+                       if (child_sa &&
+                               child_sa->get_state(child_sa) == CHILD_DELETING &&
+                               child_sa->get_outbound_state(child_sa) == CHILD_OUTBOUND_NONE)
+                       {       /* ignore rekeyed CHILD_SAs we keep around */
+                               return;
+                       }
+                       this->child_sa = child_sa;
                }
        }
 }
@@ -160,14 +168,21 @@ METHOD(task_t, build_i, status_t,
        {       /* check if it is an outbound CHILD_SA */
                this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
                                                                                                        this->spi, FALSE);
-               if (!this->child_sa)
-               {       /* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA
-                        * exchange is invalid, we fall back to an INFORMATIONAL exchange.*/
-                       message->set_exchange_type(message, INFORMATIONAL);
-                       return SUCCESS;
+               if (this->child_sa)
+               {
+                       /* we work only with the inbound SPI */
+                       this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
                }
-               /* we work only with the inbound SPI */
-               this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
+       }
+       if (!this->child_sa ||
+               (!this->child_create &&
+                 this->child_sa->get_state(this->child_sa) != CHILD_INSTALLED) ||
+               (this->child_create &&
+                this->child_sa->get_state(this->child_sa) != CHILD_REKEYING))
+       {
+               /* CHILD_SA is gone or in the wrong state, unable to rekey */
+               message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
+               return SUCCESS;
        }
        config = this->child_sa->get_config(this->child_sa);
 
@@ -220,6 +235,7 @@ METHOD(task_t, build_r, status_t,
        child_cfg_t *config;
        uint32_t reqid;
        child_sa_state_t state;
+       child_sa_t *child_sa;
 
        if (!this->child_sa)
        {
@@ -253,7 +269,10 @@ METHOD(task_t, build_r, status_t,
                return SUCCESS;
        }
 
+       child_sa = this->child_create->get_child(this->child_create);
        this->child_sa->set_state(this->child_sa, CHILD_REKEYED);
+       this->child_sa->set_rekey_spi(this->child_sa,
+                                                                 child_sa->get_spi(child_sa, FALSE));
 
        /* invoke rekey hook */
        charon->bus->child_rekey(charon->bus, this->child_sa,
@@ -455,9 +474,18 @@ METHOD(child_rekey_t, collide, void,
        if (other->get_type(other) == TASK_CHILD_REKEY)
        {
                private_child_rekey_t *rekey = (private_child_rekey_t*)other;
+               child_sa_t *other_child;
+
                if (rekey->child_sa != this->child_sa)
+               {       /* not the same child => no collision */
+                       other->destroy(other);
+                       return;
+               }
+               /* ignore passive tasks that did not successfully create a CHILD_SA */
+               other_child = rekey->child_create->get_child(rekey->child_create);
+               if (!other_child ||
+                        other_child->get_state(other_child) != CHILD_INSTALLED)
                {
-                       /* not the same child => no collision */
                        other->destroy(other);
                        return;
                }